[PATCH] drm/gem: Fix resource leaks in drm_gem_huge_mnt_create() error paths

[PATCH] drm/gem: Fix resource leaks in drm_gem_huge_mnt_create() error paths

[yaolu]

From: Lu Yao <yaolu@kylinos.cn>

Fix two resource leaks in error handling paths:
- Release filesystem type reference obtained by get_fs_type()
- Release fs_context allocated by fs_context_for_mount()

Fixes: 6e0b1b82017b ("drm/gem: Add huge tmpfs mountpoint helpers")
Signed-off-by: Lu Yao <yaolu@kylinos.cn>
---
 drivers/gpu/drm/drm_gem.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 3b2448a3a9de..6568fbdc4641 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -122,19 +122,24 @@ int drm_gem_huge_mnt_create(struct drm_device *dev, const char *value)
 	if (unlikely(!type))
 		return -EOPNOTSUPP;
 	fc = fs_context_for_mount(type, SB_KERNMOUNT);
+	put_filesystem(type);
 	if (IS_ERR(fc))
 		return PTR_ERR(fc);
 	ret = vfs_parse_fs_string(fc, "source", "tmpfs");
 	if (unlikely(ret))
-		return -ENOPARAM;
+		goto err;
 	ret = vfs_parse_fs_string(fc, "huge", value);
 	if (unlikely(ret))
-		return -ENOPARAM;
+		goto err;
 
 	dev->huge_mnt = fc_mount_longterm(fc);
 	put_fs_context(fc);
 
 	return drmm_add_action_or_reset(dev, drm_gem_huge_mnt_free, NULL);
+
+err:
+	put_fs_context(fc);
+	return -ENOPARAM;
 }
 EXPORT_SYMBOL_GPL(drm_gem_huge_mnt_create);
 #endif
-- 
2.25.1

Re: [PATCH] drm/gem: Fix resource leaks in drm_gem_huge_mnt_create() error paths

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] drm_gem_huge_mnt_create() leaves an ERR_PTR or a freed pointer in dev->huge_mnt on failure, leading to cascading failures or Use-After-Free during GEM object creation.
--

commit 7e7660e13d434072f394d83fe8c601ac0c32b376
Author: Lu Yao <yaolu@kylinos.cn>

drm/gem: Fix resource leaks in drm_gem_huge_mnt_create() error paths

This commit fixes two resource leaks in the error handling paths of
drm_gem_huge_mnt_create() by releasing the filesystem type reference and
the fs_context allocated for the mount.

> diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
> index e3ed684ddcf29..6f0751d668ad9 100644
> --- a/drivers/gpu/drm/drm_gem.c
> +++ b/drivers/gpu/drm/drm_gem.c
[ ... ]
> @@ -122,19 +122,24 @@ int drm_gem_huge_mnt_create(struct drm_device *dev, const char *value)
[ ... ]
>  	ret = vfs_parse_fs_string(fc, "huge", value);
>  	if (unlikely(ret))
> -		return -ENOPARAM;
> +		goto err;
>  
>  	dev->huge_mnt = fc_mount_longterm(fc);
>  	put_fs_context(fc);
>  
>  	return drmm_add_action_or_reset(dev, drm_gem_huge_mnt_free, NULL);

[Severity: Critical]
This is a pre-existing issue, but does this leave an invalid pointer in
dev->huge_mnt on failure?

If fc_mount_longterm() fails and returns an ERR_PTR, it gets unconditionally
assigned to dev->huge_mnt. If drmm_add_action_or_reset() then succeeds,
drm_gem_get_huge_mnt() will later return this ERR_PTR. This bypasses the NULL
check in drm_gem_object_init() and causes shmem_file_setup_with_mnt() to fail
for subsequent allocations.

Additionally, if drmm_add_action_or_reset() fails, it triggers its cleanup
action drm_gem_huge_mnt_free(), which calls kern_unmount(dev->huge_mnt).
However, dev->huge_mnt is not reset to NULL. Later, drm_gem_object_init()
could pass this freed pointer to shmem_file_setup_with_mnt(), resulting in
a use-after-free.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260609022504.65722-1-yaolu@kylinos.cn?part=1