In test-drm_dp_mst_helper.c file, if the initialization of txmsg fails in sideband_msg_req_encode_decode(), this function will directly return false and forget to free the variable out, which will lead to a possible memory leak.

Although this bug is not serious as it belongs to testing code, it is better to be fixed to avoid unexpected behavior in testing.

I fix this bug by changing 'return false' to 'goto out'.

This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs.

Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug.

we build kernel with CONFIG_DRM_DEBUG_SELFTEST=m and show no warnings. Also our static analyzer no longer warns.

Fixes: 09234b88ef55 ( "drm/selftests/test-drm_dp_mst_helper: Move 'sideband_msg_req_encode_decode' onto the heap") Signed-off-by: Zhou Qingyang zhou1615@umn.edu --- drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c b/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c index 6b4759ed6bfd..e74cea9dafc6 100644 --- a/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c +++ b/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c @@ -132,7 +132,7 @@ sideband_msg_req_encode_decode(struct drm_dp_sideband_msg_req_body *in)

txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL); if (!txmsg) - return false; + goto out;

drm_dp_encode_sideband_req(in, txmsg); ret = drm_dp_decode_sideband_req(txmsg, out);