merged Bruce
On Tue, Mar 17, 2020 at 3:01 AM Wang Mingyu <[email protected]> wrote: > > Security Advisory > > Backport from v5.4 > Reference to upstream patch: > https://github.com/torvalds/linux/commit/57be09c6e8747bf48704136d9e3f92bfb93f5725 > > drm/amdgpu: fix multiple memory leaks in acp_hw_init > > In acp_hw_init there are some allocations that needs to be released in > case of failure: > > 1- adev->acp.acp_genpd should be released if any allocation attemp for > adev->acp.acp_cell, adev->acp.acp_res or i2s_pdata fails. > 2- all of those allocations should be released if > mfd_add_hotplug_devices or pm_genpd_add_device fail. > 3- Release is needed in case of time out values expire. > > Reviewed-by: Christian König <[email protected]> > Signed-off-by: Navid Emamdoost <[email protected]> > Signed-off-by: Alex Deucher <[email protected]> > > Signed-off-by: Wang Mingyu <[email protected]> > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 32 ++++++++++++++++--------- > 1 file changed, 21 insertions(+), 11 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c > index 71efcf38f..1336db835 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c > @@ -276,7 +276,7 @@ static int acp_hw_init(void *handle) > u32 val = 0; > u32 count = 0; > struct device *dev; > - struct i2s_platform_data *i2s_pdata; > + struct i2s_platform_data *i2s_pdata = NULL; > > struct amdgpu_device *adev = (struct amdgpu_device *)handle; > > @@ -317,20 +317,21 @@ static int acp_hw_init(void *handle) > adev->acp.acp_cell = kcalloc(ACP_DEVS, sizeof(struct mfd_cell), > GFP_KERNEL); > > - if (adev->acp.acp_cell == NULL) > + if (adev->acp.acp_cell == NULL) { > return -ENOMEM; > + goto failure; > + } > > adev->acp.acp_res = kcalloc(5, sizeof(struct resource), GFP_KERNEL); > if (adev->acp.acp_res == NULL) { > - kfree(adev->acp.acp_cell); > - return -ENOMEM; > + r = -ENOMEM; > + goto failure; > } > > i2s_pdata = kcalloc(3, sizeof(struct i2s_platform_data), GFP_KERNEL); > if (i2s_pdata == NULL) { > - kfree(adev->acp.acp_res); > - kfree(adev->acp.acp_cell); > - return -ENOMEM; > + r = -ENOMEM; > + goto failure; > } > > switch (adev->asic_type) { > @@ -427,7 +428,7 @@ static int acp_hw_init(void *handle) > r = mfd_add_hotplug_devices(adev->acp.parent, adev->acp.acp_cell, > ACP_DEVS); > if (r) > - return r; > + goto failure; > > if (adev->asic_type != CHIP_STONEY) { > for (i = 0; i < ACP_DEVS ; i++) { > @@ -435,7 +436,7 @@ static int acp_hw_init(void *handle) > r = pm_genpd_add_device(&adev->acp.acp_genpd->gpd, > dev); > if (r) { > dev_err(dev, "Failed to add dev to genpd\n"); > - return r; > + goto failure; > } > } > } > @@ -454,7 +455,8 @@ static int acp_hw_init(void *handle) > break; > if (--count == 0) { > dev_err(&adev->pdev->dev, "Failed to reset ACP\n"); > - return -ETIMEDOUT; > + r = -ETIMEDOUT; > + goto failure; > } > udelay(100); > } > @@ -471,7 +473,8 @@ static int acp_hw_init(void *handle) > break; > if (--count == 0) { > dev_err(&adev->pdev->dev, "Failed to reset ACP\n"); > - return -ETIMEDOUT; > + r = -ETIMEDOUT; > + goto failure; > } > udelay(100); > } > @@ -480,6 +483,13 @@ static int acp_hw_init(void *handle) > val &= ~ACP_SOFT_RESET__SoftResetAud_MASK; > cgs_write_register(adev->acp.cgs_device, mmACP_SOFT_RESET, val); > return 0; > + > +failure: > + kfree(i2s_pdata); > + kfree(adev->acp.acp_res); > + kfree(adev->acp.acp_cell); > + kfree(adev->acp.acp_genpd); > + return r; > } > > /** > -- > 2.17.1 > > > > -- - Thou shalt not follow the NULL pointer, for chaos and madness await thee at its end - "Use the force Harry" - Gandalf, Star Trek II
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#8509): https://lists.yoctoproject.org/g/linux-yocto/message/8509 Mute This Topic: https://lists.yoctoproject.org/mt/72019120/21656 Group Owner: [email protected] Unsubscribe: https://lists.yoctoproject.org/g/linux-yocto/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
