Skip to content

Commit c2a88e8

Browse files
author
Jocelyn Falempe
committed
drm/client: Fix memory leak in drm_client_target_cloned
dmt_mode is allocated and never freed in this function. It was found with the ast driver, but most drivers using generic fbdev setup are probably affected. This fixes the following kmemleak report: backtrace: [<00000000b391296d>] drm_mode_duplicate+0x45/0x220 [drm] [<00000000e45bb5b3>] drm_client_target_cloned.constprop.0+0x27b/0x480 [drm] [<00000000ed2d3a37>] drm_client_modeset_probe+0x6bd/0xf50 [drm] [<0000000010e5cc9d>] __drm_fb_helper_initial_config_and_unlock+0xb4/0x2c0 [drm_kms_helper] [<00000000909f82ca>] drm_fbdev_client_hotplug+0x2bc/0x4d0 [drm_kms_helper] [<00000000063a69aa>] drm_client_register+0x169/0x240 [drm] [<00000000a8c61525>] ast_pci_probe+0x142/0x190 [ast] [<00000000987f19bb>] local_pci_probe+0xdc/0x180 [<000000004fca231b>] work_for_cpu_fn+0x4e/0xa0 [<0000000000b85301>] process_one_work+0x8b7/0x1540 [<000000003375b17c>] worker_thread+0x70a/0xed0 [<00000000b0d43cd9>] kthread+0x29f/0x340 [<000000008d770833>] ret_from_fork+0x1f/0x30 unreferenced object 0xff11000333089a00 (size 128): cc: <stable@vger.kernel.org> Fixes: 1d42bbc ("drm/fbdev: fix cloning on fbcon") Reported-by: Zhang Yi <yizhan@redhat.com> Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/20230711092203.68157-2-jfalempe@redhat.com
1 parent 835a65f commit c2a88e8

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

drivers/gpu/drm/drm_client_modeset.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,9 @@ static bool drm_client_target_cloned(struct drm_device *dev,
311311
can_clone = true;
312312
dmt_mode = drm_mode_find_dmt(dev, 1024, 768, 60, false);
313313

314+
if (!dmt_mode)
315+
goto fail;
316+
314317
for (i = 0; i < connector_count; i++) {
315318
if (!enabled[i])
316319
continue;
@@ -326,11 +329,13 @@ static bool drm_client_target_cloned(struct drm_device *dev,
326329
if (!modes[i])
327330
can_clone = false;
328331
}
332+
kfree(dmt_mode);
329333

330334
if (can_clone) {
331335
DRM_DEBUG_KMS("can clone using 1024x768\n");
332336
return true;
333337
}
338+
fail:
334339
DRM_INFO("kms: can't enable cloning when we probably wanted to.\n");
335340
return false;
336341
}

0 commit comments

Comments
 (0)