From patchwork Fri Apr 8 05:12:13 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ben Skeggs X-Patchwork-Id: 694021 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id p388EDte003611 for ; Fri, 8 Apr 2011 08:15:27 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752712Ab1DHFNF (ORCPT ); Fri, 8 Apr 2011 01:13:05 -0400 Received: from mail-qy0-f181.google.com ([209.85.216.181]:41006 "EHLO mail-qy0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752684Ab1DHFNF (ORCPT ); Fri, 8 Apr 2011 01:13:05 -0400 Received: by qyg14 with SMTP id 14so2250169qyg.19 for ; Thu, 07 Apr 2011 22:13:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:from:to:cc:subject:date:message-id:x-mailer; bh=3EMVCoblW1LsPDX5SsHy5rzG+/euPum3XNFrimrAj2k=; b=J7gIAQ1QGhkqeWp2DMvnOwwLnQY5q2QignGaKhY96lHnZCpOto+loePwSdzHtkauFU mLyeNC9m+dK0qIYVlaH9ULBxy5rcnipUgfkcLi5nF3D1ho8pVZfCYNYRZq/nyyNtSJxk /fO97qcfFdkTtJb2aeLjTMK6IQRkpzgOq24e0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer; b=lwYKooKcxlKMi+KrABmoGOuPmExhfngDNzDMWHWzuuiWEgVxEOLbXqtcsI3UgNZxeY ScvLX+IrQXjTfk+7lg/q/EYRe1CDxxwYI/WTp7ma0JQOVN/20fPEO757jzMQTSOFiSbe IZTM+RC+MnqV3MdtOpYwFEmesfWgvMOv3pYiU= Received: by 10.224.18.202 with SMTP id x10mr1402172qaa.285.1302239584024; Thu, 07 Apr 2011 22:13:04 -0700 (PDT) Received: from nisroch.bne.redhat.com ([66.187.239.10]) by mx.google.com with ESMTPS id m7sm1704847qcg.17.2011.04.07.22.13.00 (version=SSLv3 cipher=OTHER); Thu, 07 Apr 2011 22:13:02 -0700 (PDT) From: skeggsb@gmail.com To: linux-acpi@vger.kernel.org Cc: Ulrich Obergfell , Ben Skeggs Subject: [PATCH] acpi: fix a leak of acpi_buffer objects in acpi_video_get_edid() Date: Fri, 8 Apr 2011 15:12:13 +1000 Message-Id: <1302239533-26893-1-git-send-email-skeggsb@gmail.com> X-Mailer: git-send-email 1.7.4.2 Sender: linux-acpi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-acpi@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Fri, 08 Apr 2011 08:15:28 +0000 (UTC) From: Ulrich Obergfell Commit 24b102d3488c9d201915d070a519e07098e0cd30 modified nouveau to take a copy of the data returned by acpi_video_get_edid() to prevent an invalid free later on. This left a leak of the acpi_buffer. A correct fix involves modifying the ACPI code to return a copy of the EDID data, and freeing the acpi_buffer. Signed-off-by: Ulrich Obergfell Signed-off-by: Ben Skeggs --- drivers/acpi/video.c | 8 ++++++-- drivers/gpu/drm/nouveau/nouveau_acpi.c | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c index 31e9e10..e63ab12 100644 --- a/drivers/acpi/video.c +++ b/drivers/acpi/video.c @@ -1332,8 +1332,12 @@ int acpi_video_get_edid(struct acpi_device *device, int type, int device_id, } } - *edid = buffer->buffer.pointer; - return length; + *edid = kmemdup(buffer->buffer.pointer, buffer->buffer.length, GFP_KERNEL); + kfree(buffer); + if (*edid) + return length; + else + return -ENOMEM; } return -ENODEV; diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c index a542380..2d51a38 100644 --- a/drivers/gpu/drm/nouveau/nouveau_acpi.c +++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c @@ -297,6 +297,6 @@ nouveau_acpi_edid(struct drm_device *dev, struct drm_connector *connector) if (ret < 0) return ret; - nv_connector->edid = kmemdup(edid, EDID_LENGTH, GFP_KERNEL); + nv_connector->edid = edid; return 0; }