github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-25 09:41:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/msm: Move nr_cmds initialization

Browse Source 
Previously if we entered an error path between these two points, we
could leak the relocs tables due to submit->nr_cmds still being zero.

In practice, relocs are disallowed on a6xx+, and non-ancient userspace
will not use relocs on earlier gens unless running on an ancient kernel.
But userspace could use this to trigger a memory leak.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/743085/
Message-ID: <20260729155609.20190-6-robin.clark@oss.qualcomm.com>
This commit is contained in:
Rob Clark 2026-07-29 08:55:42 -07:00
parent 2b1bfcb59d
commit 9ee2884ed5
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/gpu/drm/msm/msm_gem_submit.c
View File

@ -260,6 +260,9 @@ static int submit_lookup_cmds(struct msm_gem_submit *submit,
ret = -ENOMEM;
goto out;
}
submit->nr_cmds = i + 1;
ret = copy_from_user(submit->cmd[i].relocs, userptr, sz);
if (ret) {
ret = -EFAULT;
@ -719,8 +722,6 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
goto out;
}
submit->nr_cmds = args->nr_cmds;
idr_preload(GFP_KERNEL);
spin_lock(&queue->idr_lock);