From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9EEBE3B6366; Thu, 30 Jul 2026 15:12:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785424365; cv=none; b=MMlwY4uh4SI/R5STsga3t4g+9IropZNR/A06P+99mc5wJWRlFIEcXsRLKmaK2xSZt+YiutTy/+vlO1fkNrJ9I/6SMjCBy/vlMjaXHOcBc0jeFjtMcSAxdecoekN+Xt8dQKDwAwHVrQOUxX39id+5U97prAyIZ0E59Tqz8UURpek= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785424365; c=relaxed/simple; bh=JRDhReXx5buJWhlWP1S9dt7yUn7GL2cIoQa8jpBvdiE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=J2qhuoVHC5UpUIEh57B5nKW3G4IbyjlPXYGFdIzvU7wR7I1X6KfQ/W08FyG4qi/snMf7Y5myiuOICFGCAa2L+jzxOh9FzA5rWlai2X0CjEIYPc3NtO6j/2IpQuw5IyhCgKqa/+PIVj20u5vSdsi3W2yxHZ8orl1ozJyunmxCj+M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=B7w/QNO8; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="B7w/QNO8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0F3371F00A3A; Thu, 30 Jul 2026 15:12:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785424364; bh=jwqr5wE2TYnGRU9W3ymu9++j17pkdqXl7FawPhbRGeE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=B7w/QNO8AZz5Pjrpx3P5JTPo8ip0mhLdsXINYSg0y0sBdcpZl0xKJM+JuoB6prs5+ Lb8Hb+jmM4wOdZbeHu7h+z3RdEJd7TgVwIkgxSz4WLyfL9+/adEWtkOhYHmheLnvy6 otQ4F+kAF3s+qf6gvFzRQZENWZl6ThLI05nis/4U= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Martin Hodo , Faith Ekstrand , Simona Vetter , Tvrtko Ursulin , Maarten Lankhorst , Joonas Lahtinen , Tvrtko Ursulin , Rodrigo Vivi Subject: [PATCH 6.18 369/675] drm/i915/gem: Do not leak siblings[] on proto context error Date: Thu, 30 Jul 2026 16:11:39 +0200 Message-ID: <20260730141452.971855770@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260730141445.110192266@linuxfoundation.org> References: <20260730141445.110192266@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joonas Lahtinen commit eed3de2acf6aa5154d49098b026710b646db67ee upstream. After a successful BALANCE/PARALLEL_SUBMIT extension on context creation, error during processing of next user extension leaks the siblings[] array. Fix that. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") Cc: Faith Ekstrand Cc: Simona Vetter Cc: Tvrtko Ursulin Cc: Maarten Lankhorst Cc: # v5.15+ Signed-off-by: Joonas Lahtinen Reviewed-by: Maarten Lankhorst Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260701073030.44850-1-joonas.lahtinen@linux.intel.com (cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff) Signed-off-by: Rodrigo Vivi Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/i915/gem/i915_gem_context.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) --- a/drivers/gpu/drm/i915/gem/i915_gem_context.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c @@ -770,8 +770,8 @@ static int set_proto_ctx_engines(struct struct intel_engine_cs *engine; if (copy_from_user(&ci, &user->engines[n], sizeof(ci))) { - kfree(set.engines); - return -EFAULT; + err = -EFAULT; + goto err; } memset(&set.engines[n], 0, sizeof(set.engines[n])); @@ -787,8 +787,8 @@ static int set_proto_ctx_engines(struct drm_dbg(&i915->drm, "Invalid engine[%d]: { class:%d, instance:%d }\n", n, ci.engine_class, ci.engine_instance); - kfree(set.engines); - return -ENOENT; + err = -ENOENT; + goto err; } set.engines[n].type = I915_GEM_ENGINE_TYPE_PHYSICAL; @@ -801,15 +801,21 @@ static int set_proto_ctx_engines(struct set_proto_ctx_engines_extensions, ARRAY_SIZE(set_proto_ctx_engines_extensions), &set); - if (err) { - kfree(set.engines); - return err; - } + if (err) + goto err_extensions; pc->num_user_engines = set.num_engines; pc->user_engines = set.engines; return 0; + +err_extensions: + for (n = 0; n < set.num_engines; n++) + kfree(set.engines[n].siblings); +err: + kfree(set.engines); + + return err; } static int set_proto_ctx_sseu(struct drm_i915_file_private *fpriv,