From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D3AFE446050; Thu, 30 Jul 2026 16:09:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785427751; cv=none; b=SByrUTApvPT30/LnU/+kCB0sdi0hZlB4/Kt15kgKZOZclkVEkDBe2MVD6B8GreXj+77onndx+G5ghfgfJqTKWyEy3j+2LlulD1ao9M9pexAR1MRaZwg1BkSZN3MfFJHUPQYMuOSxxA4kXTWUeitUfhz79aUJyBi/wDeheGk4fgk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785427751; c=relaxed/simple; bh=edHoF1ORfkocVh+ciS5FXcu/9+dXWZWInEiLXyVwCZk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=T6tm2KcRejchXAG5x1x4eHs/IAk7P9c9opOZ1gH1LZCyHo5e31wjGWlGQ6RyErltRQtJKBH6Y7X26hzy68KIBhV9ma+GCwwyL7ISVI1ZnBMysbJoE1W6WFZqiaJuFKTmMIRmLVv+oa7XQHNYJwY+AtvGhqpVWMk8g881TAPBV+c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=nfVe1WBd; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="nfVe1WBd" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 447CC1F000E9; Thu, 30 Jul 2026 16:09:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785427749; bh=TfxWCLMfPv4+yCzQjZYjO6aKl7FhhiaBhJhTcnjEgio=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=nfVe1WBdSONOPXv7mI/KTXCzO3RSHAuDlb3xVcytnDUl2bwcEnyvpgNcZLOVya/H4 t+O2/NL4XR+RFLSRU1jpPBWWjEqFa4Ncbjy8eY/e1meNvWt+Sd9SWoOUGAwwfCOE4e YVIRkeQILGIzjoEH0D5ZuXAeZuLEYc+Kug91sH7E= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Martin Hodo , Faith Ekstrand , Simona Vetter , Tvrtko Ursulin , Maarten Lankhorst , Joonas Lahtinen , Tvrtko Ursulin , Rodrigo Vivi Subject: [PATCH 6.6 226/484] drm/i915/gem: Do not leak siblings[] on proto context error Date: Thu, 30 Jul 2026 16:12:03 +0200 Message-ID: <20260730141428.383517561@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260730141423.392222816@linuxfoundation.org> References: <20260730141423.392222816@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joonas Lahtinen commit eed3de2acf6aa5154d49098b026710b646db67ee upstream. After a successful BALANCE/PARALLEL_SUBMIT extension on context creation, error during processing of next user extension leaks the siblings[] array. Fix that. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") Cc: Faith Ekstrand Cc: Simona Vetter Cc: Tvrtko Ursulin Cc: Maarten Lankhorst Cc: # v5.15+ Signed-off-by: Joonas Lahtinen Reviewed-by: Maarten Lankhorst Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260701073030.44850-1-joonas.lahtinen@linux.intel.com (cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff) Signed-off-by: Rodrigo Vivi Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/i915/gem/i915_gem_context.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) --- a/drivers/gpu/drm/i915/gem/i915_gem_context.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c @@ -768,8 +768,8 @@ static int set_proto_ctx_engines(struct struct intel_engine_cs *engine; if (copy_from_user(&ci, &user->engines[n], sizeof(ci))) { - kfree(set.engines); - return -EFAULT; + err = -EFAULT; + goto err; } memset(&set.engines[n], 0, sizeof(set.engines[n])); @@ -785,8 +785,8 @@ static int set_proto_ctx_engines(struct drm_dbg(&i915->drm, "Invalid engine[%d]: { class:%d, instance:%d }\n", n, ci.engine_class, ci.engine_instance); - kfree(set.engines); - return -ENOENT; + err = -ENOENT; + goto err; } set.engines[n].type = I915_GEM_ENGINE_TYPE_PHYSICAL; @@ -799,15 +799,21 @@ static int set_proto_ctx_engines(struct set_proto_ctx_engines_extensions, ARRAY_SIZE(set_proto_ctx_engines_extensions), &set); - if (err) { - kfree(set.engines); - return err; - } + if (err) + goto err_extensions; pc->num_user_engines = set.num_engines; pc->user_engines = set.engines; return 0; + +err_extensions: + for (n = 0; n < set.num_engines; n++) + kfree(set.engines[n].siblings); +err: + kfree(set.engines); + + return err; } static int set_proto_ctx_sseu(struct drm_i915_file_private *fpriv,