CVE-2026-53213: drm/vc4: fix krealloc() memory leak

CVE-2026-53213: drm/vc4: fix krealloc() memory leak

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: fix krealloc() memory leak

Don't just overwrite the original pointer passed to krealloc()
with its return value without checking latter:

    MEM = krealloc(MEM, SZ, GFP);

If krealloc() returns NULL, that erases the pointer
to the still allocated memory, hence leaks this memory.
Instead, use a temporary variable, check it's not NULL
and only then assign it to the original pointer:

    TMP = krealloc(MEM, SZ, GFP);
    if (!TMP) return;
    MEM = TMP;

While on it, use krealloc_array().

The Linux kernel CVE team has assigned CVE-2026-53213 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.8 with commit 6d45c81d229d71da54d374143e7d6abad4c0cf31 and fixed in 5.15.210 with commit 30165a09f76eaf34951c818eb5d9d6e4771d76f6
	Issue introduced in 4.8 with commit 6d45c81d229d71da54d374143e7d6abad4c0cf31 and fixed in 6.1.176 with commit fd87d6966041e33ef7d2e5dc59f9a52b71c6ae5f
	Issue introduced in 4.8 with commit 6d45c81d229d71da54d374143e7d6abad4c0cf31 and fixed in 6.6.143 with commit e0ce103e89d61eef70edc1d1ae3bfd4c0aacbc2e
	Issue introduced in 4.8 with commit 6d45c81d229d71da54d374143e7d6abad4c0cf31 and fixed in 6.12.94 with commit c034aa0b1ba5f49cbdf8ef193d6ec714d74aac27
	Issue introduced in 4.8 with commit 6d45c81d229d71da54d374143e7d6abad4c0cf31 and fixed in 6.18.36 with commit 02f5e4db57c0cdd7bac89d503b301a093a0fa95c
	Issue introduced in 4.8 with commit 6d45c81d229d71da54d374143e7d6abad4c0cf31 and fixed in 7.0.13 with commit 4fc692dc6df5bc777cc1bcebf95179e28594875f
	Issue introduced in 4.8 with commit 6d45c81d229d71da54d374143e7d6abad4c0cf31 and fixed in 7.1 with commit 5d563a5da8717629ae72f9eadf1e0e340bd1658b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-53213
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/vc4/vc4_validate_shaders.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/30165a09f76eaf34951c818eb5d9d6e4771d76f6
	https://git.kernel.org/stable/c/fd87d6966041e33ef7d2e5dc59f9a52b71c6ae5f
	https://git.kernel.org/stable/c/e0ce103e89d61eef70edc1d1ae3bfd4c0aacbc2e
	https://git.kernel.org/stable/c/c034aa0b1ba5f49cbdf8ef193d6ec714d74aac27
	https://git.kernel.org/stable/c/02f5e4db57c0cdd7bac89d503b301a093a0fa95c
	https://git.kernel.org/stable/c/4fc692dc6df5bc777cc1bcebf95179e28594875f
	https://git.kernel.org/stable/c/5d563a5da8717629ae72f9eadf1e0e340bd1658b