Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] Double-free / Use-after-free on drm_mode_object pointer during modeset lock retry --
commit 09179daaa80ba21f29576fb6c0abc2ca7e1a0fbd Author: WenTao Liang <[email protected]> fix: drm: drm_mode_obj_get_properties_ioctl: DRM_MODESET_LOCK_ALL_BEGIN retry leaks drm_mode_object reference This commit attempts to fix a memory leak during deadlock retries by calling drm_mode_object_put() at the start of the lock block. It modifies the code following the DRM_MODESET_LOCK_ALL_BEGIN macro to release the object if a retry occurs. > diff --git a/drivers/gpu/drm/drm_mode_object.c > b/drivers/gpu/drm/drm_mode_object.c > index 21fc9deda4371..2360c61d1ae04 100644 > --- a/drivers/gpu/drm/drm_mode_object.c > +++ b/drivers/gpu/drm/drm_mode_object.c [ ... ] > @@ -487,6 +487,8 @@ int drm_mode_obj_get_properties_ioctl(struct drm_device > *dev, void *data, > return -EOPNOTSUPP; > > DRM_MODESET_LOCK_ALL_BEGIN(dev, ctx, 0, ret); > + if (obj) > + drm_mode_object_put(obj); > > obj = drm_mode_object_find(dev, file_priv, arg->obj_id, arg->obj_type); > if (!obj) { [Severity: Medium] Will this result in a double-free if the retry is triggered by code within the block returning -EDEADLK? If drm_mode_object_get_properties() returns -EDEADLK, the flow proceeds to the error labels: ret = drm_mode_object_get_properties(...); out_unref: drm_mode_object_put(obj); out: DRM_MODESET_LOCK_ALL_END(dev, ctx, ret); The DRM_MODESET_LOCK_ALL_END macro detects the -EDEADLK, performs backoff, and jumps to the modeset_lock_retry label located inside DRM_MODESET_LOCK_ALL_BEGIN. Since the object was already released in out_unref, and local variables retain their values across goto, the obj pointer remains non-NULL. The newly added check will then call drm_mode_object_put(obj) on the same pointer again before finding a new object, causing a double-free. Additionally, if drm_modeset_lock_all_ctx() itself returns -EDEADLK during the initial acquisition inside DRM_MODESET_LOCK_ALL_BEGIN, it jumps over the entire block. In that scenario, drm_mode_object_find() has not executed yet, so there is no object to leak. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
