Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Bernard Zhao <bernard@vivo.com>
To:     Maarten Lankhorst <maarten.lankhorst@linux.intel.com>,
        Maxime Ripard <mripard@kernel.org>,
        Thomas Zimmermann <tzimmermann@suse.de>,
        David Airlie <airlied@linux.ie>,
        Daniel Vetter <daniel@ffwll.ch>,
        dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Cc:     Bernard Zhao <bernard@vivo.com>
Subject: [PATCH] gpu/drm: fix potential memory leak
Date:   Thu, 21 Oct 2021 23:30:35 -0700
Message-Id: <20211022063036.21763-1-bernard@vivo.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?fKMippH9CT9HFNoMsCwqNkEPVrbfOn+D3vZlC/b3kovCCm5o6C0jfn8GOTnQ?=
 =?us-ascii?Q?0LldrHKXKVuNXmy+ewuMqDPYjm5VDCtMWSxsKBJDNlgNGI1ThKLss7zUHI4z?=
 =?us-ascii?Q?bJidLWpgbXiX1/CYQ444cGnuuR4hmA3ukNm4sBIXnZ6yj3d+ib3oo3oPkZ3A?=
 =?us-ascii?Q?5mnmNlEXSU+MDbc0uMCodiXNSnrVHOJvwWf4IZBBQPOq+MusyI9C6pxm0g75?=
 =?us-ascii?Q?QTsoPGW8Pru+j+AK1RqhkUIZEBmAC1988/utLW2JyCx4REDkNseiwYLRgavC?=
 =?us-ascii?Q?yPgkgoFT5U79Igr7x60KijE4CbEL0w720DqF8/bNMLVJiV5U2SWR2s6fV8Gm?=
 =?us-ascii?Q?Ll1h6d95+ub9TYV+aLArbBtR8ZeFck6bMkAmDnmLHenlusfwhVsv2pIJinRJ?=
 =?us-ascii?Q?P7Lt34rjg55/IFhoOXVY0AJc9thl7C4swCjAiNcQ2nE3rU7Zr0ArPufefVVB?=
 =?us-ascii?Q?/UuZ2BLSpVaSOH7am6ZBcbdCVtS2fwy2GDiYw8a1plVICWM4950uetCzcPtq?=
 =?us-ascii?Q?0oJ/J0EmeS942gyO/2S9F3BX6xXA8MQzb/zk5Obz7WBpHjEjv2PWYzvBnXKj?=
 =?us-ascii?Q?EU0pdht9aPCMZsXPIk352oxJOl2N2Fds094428RXUfkszKyKP43+G65cDqs2?=
 =?us-ascii?Q?sCZn4MAMpdrFVILx4l95Nz83iRi0rq66nU1fDE1evPjcMJ1ovxoH6Hw3hEZi?=
 =?us-ascii?Q?2TCECOlA8FFv18CSLUIWprzESCmmYzIs/HIWTGXuc0o2O3wUhrqmJJqXOqfP?=
 =?us-ascii?Q?woum6/tf05k/oY+xQCmlDHQdgfyV5ns7wbam4Ufr+cRNgG3p1yg//TLwHONe?=
 =?us-ascii?Q?d42rI9aJgPEO0V/WGSYPVISNV5M3DvFVSumtgY0oDgH6/EyE5HOn++7+N3jm?=
 =?us-ascii?Q?3bcEeM1NwweaKNs7VW5G7JEFGpb8hG9qeZGn4Yp/XsHocpe4cJhyyNAChP0b?=
 =?us-ascii?Q?dvVXBQ5F8sRKOQDDdZmOR8M42GAdlPFiUwMUQWyTL5/a3LyvZ+dVymTsqP+Q?=
 =?us-ascii?Q?zP0gspbMuO0ow4/+S5j7jdTMP09fYpIujFImU1S8PLJpO7aIvPLhYvvavtHF?=
 =?us-ascii?Q?BrRrCB8CctMtFlpkWGz0nuoH70OMI0DFeVVaJ3lRjhyoAH3hmq4KXzOfca4i?=
 =?us-ascii?Q?zwBHvV/GI049LM6Ktdp4KStFSR3jqBMfFBwxjoMTD61S/mBZY00H7JNksUpp?=
 =?us-ascii?Q?4EyNSQ+E2Zehb3BhuLGnieqxqUpgrjCyvMu5DojKjtTzucmYz4RhVILKh2uE?=
 =?us-ascii?Q?yLOzedAu81CTKEirHZMdjL7DZCWP4fA2QWgrYDGShUJTWmTKNBnGGAlF6mK1?=
 =?us-ascii?Q?ogz2+G7B4mkVRyNPCtQO6WBd+O2BQBufwZp+JcxqAsi5ZD7Pu3gKayiErEeR?=
 =?us-ascii?Q?9eZDrxi9VcnueFXN4H63qGb++/Q32W53DmczFRtTTTU4Zo5pglUZzXJIIvn1?=
 =?us-ascii?Q?sY8egyPLD9M=3D?=
X-OriginatorOrg: vivo.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 944ffbc5-7172-4010-9543-08d995257b34
X-MS-Exchange-CrossTenant-AuthSource: PSAPR06MB4021.apcprd06.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Oct 2021 06:30:46.5576
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 923e42dc-48d5-4cbe-b582-1a797a6412ed
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 11115066@vivo.com
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PS2PR06MB2502
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

This patch try to fix memory leak reported by syzbot:
BUG: memory leak
unreferenced object 0xffff888127338180 (size 64):
  comm "syz-executor.6", pid 11434, jiffies 4294961165 (age 15.480s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 4a 0d 28 81 88 ff ff  .........J.(....
  backtrace:
    [<ffffffff825b2892>] kmalloc include/linux/slab.h:591 [inline]
    [<ffffffff825b2892>] drm_vma_node_allow+0x32/0x120 drivers/gpu/drm/drm_vma_manager.c:274
    [<ffffffff825983b7>] drm_gem_handle_create_tail+0x107/0x250 drivers/gpu/drm/drm_gem.c:390
    [<ffffffff826271bd>] vgem_gem_create drivers/gpu/drm/vgem/vgem_drv.c:203 [inline]
    [<ffffffff826271bd>] vgem_gem_dumb_create+0x8d/0x240 drivers/gpu/drm/vgem/vgem_drv.c:223
    [<ffffffff825c72f1>] drm_mode_create_dumb+0x121/0x150 drivers/gpu/drm/drm_dumb_buffers.c:96
    [<ffffffff82599660>] drm_ioctl_kernel+0xf0/0x160 drivers/gpu/drm/drm_ioctl.c:795
    [<ffffffff82599c7a>] drm_ioctl+0x2ea/0x4f0 drivers/gpu/drm/drm_ioctl.c:898
    [<ffffffff8158e45c>] vfs_ioctl fs/ioctl.c:51 [inline]
    [<ffffffff8158e45c>] __do_sys_ioctl fs/ioctl.c:1069 [inline]
    [<ffffffff8158e45c>] __se_sys_ioctl fs/ioctl.c:1055 [inline]
    [<ffffffff8158e45c>] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:1055
    [<ffffffff843b6675>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff843b6675>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84400068>] entry_SYSCALL_64_after_hwframe+0x44/0xae
The link is:
https://syzkaller.appspot.com/bug?id=bd059c6ee8aee1d3af51cff3a2849b8c0027b822

Signed-off-by: Bernard Zhao <bernard@vivo.com>
---
 drivers/gpu/drm/drm_vma_manager.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_vma_manager.c b/drivers/gpu/drm/drm_vma_manager.c
index 7de37f8c68fd..870d5bc7f1fa 100644
--- a/drivers/gpu/drm/drm_vma_manager.c
+++ b/drivers/gpu/drm/drm_vma_manager.c
@@ -300,11 +300,11 @@ int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag)
 	new->vm_count = 1;
 	rb_link_node(&new->vm_rb, parent, iter);
 	rb_insert_color(&new->vm_rb, &node->vm_files);
-	new = NULL;
 
 unlock:
 	write_unlock(&node->vm_lock);
 	kfree(new);
+	new = NULL;
 	return ret;
 }
 EXPORT_SYMBOL(drm_vma_node_allow);
-- 
2.33.1