Commit fcb4f919 authored by LongJun Tang's avatar LongJun Tang Committed by Alex Deucher

drm/amd/display: Have risk for memory exhaustion

In dcn*_clock_source_create when dcn*_clk_src_construct fails allocated
clk_src needs release. A local attack could use this to cause memory
exhaustion.
Signed-off-by: default avatarLongJun Tang <tanglongjun@kylinos.cn>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent e50db383
...@@ -1328,6 +1328,7 @@ static struct clock_source *dcn30_clock_source_create( ...@@ -1328,6 +1328,7 @@ static struct clock_source *dcn30_clock_source_create(
return &clk_src->base; return &clk_src->base;
} }
kfree(clk_src);
BREAK_TO_DEBUGGER(); BREAK_TO_DEBUGGER();
return NULL; return NULL;
} }
......
...@@ -1288,6 +1288,7 @@ static struct clock_source *dcn301_clock_source_create( ...@@ -1288,6 +1288,7 @@ static struct clock_source *dcn301_clock_source_create(
return &clk_src->base; return &clk_src->base;
} }
kfree(clk_src);
BREAK_TO_DEBUGGER(); BREAK_TO_DEBUGGER();
return NULL; return NULL;
} }
......
...@@ -464,6 +464,7 @@ static struct clock_source *dcn302_clock_source_create(struct dc_context *ctx, s ...@@ -464,6 +464,7 @@ static struct clock_source *dcn302_clock_source_create(struct dc_context *ctx, s
return &clk_src->base; return &clk_src->base;
} }
kfree(clk_src);
BREAK_TO_DEBUGGER(); BREAK_TO_DEBUGGER();
return NULL; return NULL;
} }
......
...@@ -431,6 +431,7 @@ static struct clock_source *dcn303_clock_source_create(struct dc_context *ctx, s ...@@ -431,6 +431,7 @@ static struct clock_source *dcn303_clock_source_create(struct dc_context *ctx, s
return &clk_src->base; return &clk_src->base;
} }
kfree(clk_src);
BREAK_TO_DEBUGGER(); BREAK_TO_DEBUGGER();
return NULL; return NULL;
} }
......
...@@ -1629,6 +1629,7 @@ static struct clock_source *dcn31_clock_source_create( ...@@ -1629,6 +1629,7 @@ static struct clock_source *dcn31_clock_source_create(
return &clk_src->base; return &clk_src->base;
} }
kfree(clk_src);
BREAK_TO_DEBUGGER(); BREAK_TO_DEBUGGER();
return NULL; return NULL;
} }
......
...@@ -1627,6 +1627,7 @@ static struct clock_source *dcn31_clock_source_create( ...@@ -1627,6 +1627,7 @@ static struct clock_source *dcn31_clock_source_create(
return &clk_src->base; return &clk_src->base;
} }
kfree(clk_src);
BREAK_TO_DEBUGGER(); BREAK_TO_DEBUGGER();
return NULL; return NULL;
} }
......
...@@ -830,6 +830,7 @@ static struct clock_source *dcn32_clock_source_create( ...@@ -830,6 +830,7 @@ static struct clock_source *dcn32_clock_source_create(
return &clk_src->base; return &clk_src->base;
} }
kfree(clk_src);
BREAK_TO_DEBUGGER(); BREAK_TO_DEBUGGER();
return NULL; return NULL;
} }
......
...@@ -829,6 +829,7 @@ static struct clock_source *dcn321_clock_source_create( ...@@ -829,6 +829,7 @@ static struct clock_source *dcn321_clock_source_create(
return &clk_src->base; return &clk_src->base;
} }
kfree(clk_src);
BREAK_TO_DEBUGGER(); BREAK_TO_DEBUGGER();
return NULL; return NULL;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment