From nobody Fri Sep 19 10:37:33 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 36FABC433FE for ; Fri, 25 Nov 2022 06:37:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229487AbiKYGhn (ORCPT ); Fri, 25 Nov 2022 01:37:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41298 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229472AbiKYGhl (ORCPT ); Fri, 25 Nov 2022 01:37:41 -0500 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D98C19FF1 for ; Thu, 24 Nov 2022 22:37:39 -0800 (PST) Received: from kwepemi500009.china.huawei.com (unknown [172.30.72.57]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4NJQ6q5fFczqSdm; Fri, 25 Nov 2022 14:33:39 +0800 (CST) Received: from huawei.com (10.67.175.85) by kwepemi500009.china.huawei.com (7.221.188.199) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Fri, 25 Nov 2022 14:37:36 +0800 From: Xia Fukun To: , , , , , CC: , , , , , Subject: [PATCH] drm/i915/bios: fix a memory leak in generate_lfp_data_ptrs Date: Fri, 25 Nov 2022 14:34:28 +0800 Message-ID: <20221125063428.69486-1-xiafukun@huawei.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-Originating-IP: [10.67.175.85] X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To kwepemi500009.china.huawei.com (7.221.188.199) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When (size !=3D 0 || ptrs->lvds_ entries !=3D 3), the program tries to free() the ptrs. However, the ptrs is not created by calling kzmalloc(), but is obtained by pointer offset operation. This may lead to memory leaks or undefined behavior. Fix this by replacing the arguments of kfree() with ptrs_block. Fixes: a87d0a847607 ("drm/i915/bios: Generate LFP data table pointers if th= e VBT lacks them") Signed-off-by: Xia Fukun Reviewed-by: Jani Nikula --- drivers/gpu/drm/i915/display/intel_bios.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i9= 15/display/intel_bios.c index 28bdb936cd1f..edbdb949b6ce 100644 --- a/drivers/gpu/drm/i915/display/intel_bios.c +++ b/drivers/gpu/drm/i915/display/intel_bios.c @@ -414,7 +414,7 @@ static void *generate_lfp_data_ptrs(struct drm_i915_pri= vate *i915, ptrs->lvds_entries++; =20 if (size !=3D 0 || ptrs->lvds_entries !=3D 3) { - kfree(ptrs); + kfree(ptrs_block); return NULL; } =20 --=20 2.17.1