This patch try to fix memory leak reported by syzbot: BUG: memory leak unreferenced object 0xffff888127338180 (size 64): comm "syz-executor.6", pid 11434, jiffies 4294961165 (age 15.480s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 4a 0d 28 81 88 ff ff .........J.(.... backtrace: [<ffffffff825b2892>] kmalloc include/linux/slab.h:591 [inline] [<ffffffff825b2892>] drm_vma_node_allow+0x32/0x120 drivers/gpu/drm/drm_vma_manager.c:274 [<ffffffff825983b7>] drm_gem_handle_create_tail+0x107/0x250 drivers/gpu/drm/drm_gem.c:390 [<ffffffff826271bd>] vgem_gem_create drivers/gpu/drm/vgem/vgem_drv.c:203 [inline] [<ffffffff826271bd>] vgem_gem_dumb_create+0x8d/0x240 drivers/gpu/drm/vgem/vgem_drv.c:223 [<ffffffff825c72f1>] drm_mode_create_dumb+0x121/0x150 drivers/gpu/drm/drm_dumb_buffers.c:96 [<ffffffff82599660>] drm_ioctl_kernel+0xf0/0x160 drivers/gpu/drm/drm_ioctl.c:795 [<ffffffff82599c7a>] drm_ioctl+0x2ea/0x4f0 drivers/gpu/drm/drm_ioctl.c:898 [<ffffffff8158e45c>] vfs_ioctl fs/ioctl.c:51 [inline] [<ffffffff8158e45c>] __do_sys_ioctl fs/ioctl.c:1069 [inline] [<ffffffff8158e45c>] __se_sys_ioctl fs/ioctl.c:1055 [inline] [<ffffffff8158e45c>] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:1055 [<ffffffff843b6675>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff843b6675>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [<ffffffff84400068>] entry_SYSCALL_64_after_hwframe+0x44/0xae The link is: https://syzkaller.appspot.com/bug?id=bd059c6ee8aee1d3af51cff3a2849b8c0027b82...
Signed-off-by: Bernard Zhao bernard@vivo.com --- drivers/gpu/drm/drm_vma_manager.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_vma_manager.c b/drivers/gpu/drm/drm_vma_manager.c index 7de37f8c68fd..870d5bc7f1fa 100644 --- a/drivers/gpu/drm/drm_vma_manager.c +++ b/drivers/gpu/drm/drm_vma_manager.c @@ -300,11 +300,11 @@ int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag) new->vm_count = 1; rb_link_node(&new->vm_rb, parent, iter); rb_insert_color(&new->vm_rb, &node->vm_files); - new = NULL;
unlock: write_unlock(&node->vm_lock); kfree(new); + new = NULL; return ret; } EXPORT_SYMBOL(drm_vma_node_allow);