From patchwork Wed Jul 12 10:35:52 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Stefan Bader X-Patchwork-Id: 787135 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 3x6wN571bPz9s78; Wed, 12 Jul 2017 20:36:05 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1dVEzu-0008Ph-O4; Wed, 12 Jul 2017 10:35:58 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1dVEzp-0008PH-K1 for kernel-team@lists.ubuntu.com; Wed, 12 Jul 2017 10:35:53 +0000 Received: from 1.general.smb.uk.vpn ([10.172.193.28] helo=canonical.com) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1dVEzp-0004Th-9o for kernel-team@lists.ubuntu.com; Wed, 12 Jul 2017 10:35:53 +0000 From: Stefan Bader To: kernel-team@lists.ubuntu.com Subject: [SRU Z/Y/X] drm/virtio: don't leak bo on drm_gem_object_init failure Date: Wed, 12 Jul 2017 12:35:52 +0200 Message-Id: <1499855752-18934-1-git-send-email-stefan.bader@canonical.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com From: Gerd Hoffmann Reported-by: 李强 Signed-off-by: Gerd Hoffmann Link: http://patchwork.freedesktop.org/patch/msgid/20170406155941.458-1-kraxel@redhat.com CVE-2017-10810 (cherry picked from commit 385aee965b4e4c36551c362a334378d2985b722a) Signed-off-by: Stefan Bader Acked-by: Seth Forshee Acked-by: Kleber Sacilotto de Souza --- Fix pending in upstream 4.4.y queue. Can be cherry-picked into Z/Y/X. Before v4.2 the virtio gpu driver did not exist. So T is not affected. I updated the tracker with the correct breaks SHA1. -Stefan drivers/gpu/drm/virtio/virtgpu_object.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c index 1483dae..6f66b73 100644 --- a/drivers/gpu/drm/virtio/virtgpu_object.c +++ b/drivers/gpu/drm/virtio/virtgpu_object.c @@ -81,8 +81,10 @@ int virtio_gpu_object_create(struct virtio_gpu_device *vgdev, return -ENOMEM; size = roundup(size, PAGE_SIZE); ret = drm_gem_object_init(vgdev->ddev, &bo->gem_base, size); - if (ret != 0) + if (ret != 0) { + kfree(bo); return ret; + } bo->dumb = false; virtio_gpu_init_ttm_placement(bo, pinned);