From de1c3d4474562e9d9dc9952f9283f07d8d58ef98 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Wed, 12 Jul 2017 12:35:52 +0200 Subject: [PATCH 1/3] drm/virtio: don't leak bo on drm_gem_object_init failure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reported-by: 李强 Signed-off-by: Gerd Hoffmann Link: http://patchwork.freedesktop.org/patch/msgid/20170406155941.458-1-kraxel@redhat.com CVE-2017-10810 (cherry picked from commit 385aee965b4e4c36551c362a334378d2985b722a) Signed-off-by: Stefan Bader Acked-by: Seth Forshee Acked-by: Kleber Sacilotto de Souza Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Thomas Lamprecht --- drivers/gpu/drm/virtio/virtgpu_object.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c index 1483daebe057..6f66b7347cd0 100644 --- a/drivers/gpu/drm/virtio/virtgpu_object.c +++ b/drivers/gpu/drm/virtio/virtgpu_object.c @@ -81,8 +81,10 @@ int virtio_gpu_object_create(struct virtio_gpu_device *vgdev, return -ENOMEM; size = roundup(size, PAGE_SIZE); ret = drm_gem_object_init(vgdev->ddev, &bo->gem_base, size); - if (ret != 0) + if (ret != 0) { + kfree(bo); return ret; + } bo->dumb = false; virtio_gpu_init_ttm_placement(bo, pinned); -- 2.11.0