Skip to content

Commit

Permalink
drm/amd/display: Have risk for memory exhaustion
Browse files Browse the repository at this point in the history
In dcn*_clock_source_create when dcn*_clk_src_construct fails allocated
clk_src needs release. A local attack could use this to cause memory
exhaustion.

Signed-off-by: LongJun Tang <tanglongjun@kylinos.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
  • Loading branch information
LongJun Tang authored and Alex Deucher committed Nov 9, 2022
1 parent e50db38 commit fcb4f91
Show file tree
Hide file tree
Showing 8 changed files with 8 additions and 0 deletions.
1 change: 1 addition & 0 deletions drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
Original file line number Diff line number Diff line change
Expand Up @@ -1328,6 +1328,7 @@ static struct clock_source *dcn30_clock_source_create(
return &clk_src->base;
}

kfree(clk_src);
BREAK_TO_DEBUGGER();
return NULL;
}
Expand Down
1 change: 1 addition & 0 deletions drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c
Original file line number Diff line number Diff line change
Expand Up @@ -1288,6 +1288,7 @@ static struct clock_source *dcn301_clock_source_create(
return &clk_src->base;
}

kfree(clk_src);
BREAK_TO_DEBUGGER();
return NULL;
}
Expand Down
1 change: 1 addition & 0 deletions drivers/gpu/drm/amd/display/dc/dcn302/dcn302_resource.c
Original file line number Diff line number Diff line change
Expand Up @@ -464,6 +464,7 @@ static struct clock_source *dcn302_clock_source_create(struct dc_context *ctx, s
return &clk_src->base;
}

kfree(clk_src);
BREAK_TO_DEBUGGER();
return NULL;
}
Expand Down
1 change: 1 addition & 0 deletions drivers/gpu/drm/amd/display/dc/dcn303/dcn303_resource.c
Original file line number Diff line number Diff line change
Expand Up @@ -431,6 +431,7 @@ static struct clock_source *dcn303_clock_source_create(struct dc_context *ctx, s
return &clk_src->base;
}

kfree(clk_src);
BREAK_TO_DEBUGGER();
return NULL;
}
Expand Down
1 change: 1 addition & 0 deletions drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c
Original file line number Diff line number Diff line change
Expand Up @@ -1629,6 +1629,7 @@ static struct clock_source *dcn31_clock_source_create(
return &clk_src->base;
}

kfree(clk_src);
BREAK_TO_DEBUGGER();
return NULL;
}
Expand Down
1 change: 1 addition & 0 deletions drivers/gpu/drm/amd/display/dc/dcn315/dcn315_resource.c
Original file line number Diff line number Diff line change
Expand Up @@ -1627,6 +1627,7 @@ static struct clock_source *dcn31_clock_source_create(
return &clk_src->base;
}

kfree(clk_src);
BREAK_TO_DEBUGGER();
return NULL;
}
Expand Down
1 change: 1 addition & 0 deletions drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c
Original file line number Diff line number Diff line change
Expand Up @@ -830,6 +830,7 @@ static struct clock_source *dcn32_clock_source_create(
return &clk_src->base;
}

kfree(clk_src);
BREAK_TO_DEBUGGER();
return NULL;
}
Expand Down
1 change: 1 addition & 0 deletions drivers/gpu/drm/amd/display/dc/dcn321/dcn321_resource.c
Original file line number Diff line number Diff line change
Expand Up @@ -829,6 +829,7 @@ static struct clock_source *dcn321_clock_source_create(
return &clk_src->base;
}

kfree(clk_src);
BREAK_TO_DEBUGGER();
return NULL;
}
Expand Down

0 comments on commit fcb4f91

Please sign in to comment.