On 17/06/2026 16.26, Wentao Liang wrote:
The variable `buf` in `fast_req_dump()` is declared with `__cleanup(kfree)`, which passes `&buf` (the stack address of the pointer variable) to kfree() rather than the heap address stored in `buf`. This would cause an invalid free of a stack address, leading to memory corruption or a crash.`__cleanup(func)` is designed for value-typed variables where the cleanup function should receive a pointer to the variable. For heap-allocated pointers, `__free(kfree)` must be used instead, since DEFINE_FREE creates a wrapper that correctly dereferences the pointer before passing it to kfree(). This is the same class of bug recorded in CVE-2026-45959 and fixed by commit d5abcc33ee76 ("crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree"). Fixes: ea944d57eac7 ("drm/xe/guc_ct: Cleanup ifdef'ry") Cc: [email protected] Signed-off-by: Wentao Liang <[email protected]> --- drivers/gpu/drm/xe/xe_guc_ct.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xe/xe_guc_ct.c b/drivers/gpu/drm/xe/xe_guc_ct.c index a11cff7a20be..73867a5cbe3a 100644 --- a/drivers/gpu/drm/xe/xe_guc_ct.c +++ b/drivers/gpu/drm/xe/xe_guc_ct.c @@ -116,7 +116,7 @@ static void fast_req_dump(struct xe_guc_ct *ct, u16 fence, unsigned int slot) { struct xe_gt *gt = ct_to_gt(ct); #if IS_ENABLED(CONFIG_DRM_XE_DEBUG_GUC) - char *buf __cleanup(kfree) = kmalloc(SZ_4K, GFP_NOWAIT); + char *buf __free(kfree) = kmalloc(SZ_4K, GFP_NOWAIT);if (buf && stack_depot_snprint(ct->fast_req[slot].stack, buf, SZ_4K, 0))xe_gt_err(gt, "Fence 0x%x was used by action %#04x sent at:\n%s\n",
Reviewed-by: Thomas Huth <[email protected]>
