From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CE21B429802; Thu, 30 Jul 2026 14:40:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785422444; cv=none; b=f5JvyOkH3iqqxedPlLfyaFQP2XJdKG9rhVz814JLxEg8QCpBleXnjnD435fklP+65VMUYEDwBVfVVQM0thxyxfumbZ/4YiCTopeN0EbgjZeTHxgdMlReiGb5AhPg1/zyZ0Ht2H+q0Q2I9Xb527HEdTogE5T0JI/y7+rj/+VUhRY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785422444; c=relaxed/simple; bh=RxOGQfg7k0I71n3NC1SooSj1z4uoghSxZDK+uatbviE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Zuou6oqxNmB8uw8Y71LScZGO1O0mWrthRRC1NqYkqAp9LDRvDgnYtJuPGoAwaxiQRk/Jcsf1vq+ikSrmH/7re48AEL6M3xGVdTrgduZrcZ0NdV22QSl9WNU21fy8VG8xyy9a64sUrG6wwnYNXOV4ErzdIEQXXzvmih8wKFaOQs0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=S0ReMR+k; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="S0ReMR+k" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3E41B1F000E9; Thu, 30 Jul 2026 14:40:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785422442; bh=omwQ2yiLxo1hZbm9Gt8X7bCJ+72937d9HcCtcpBOhCU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=S0ReMR+kyZMIUi3D/t6N0Y+3dKchxSc8+OzjFB8KGyPAYI+r5zCvcUwk/aK1zJ017 nMRs9I5UcRgO4owfkKax8A32UWQwyFvqn7EBqmdGPUFk4d49aOUK8ChG42jSpIuEd4 7Xi+3VKnUL1cmlXPceRijMjkaYKY5o5DLb/+Gj9I= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Martin Hodo , Faith Ekstrand , Simona Vetter , Tvrtko Ursulin , Maarten Lankhorst , Joonas Lahtinen , Tvrtko Ursulin , Rodrigo Vivi Subject: [PATCH 7.1 439/744] drm/i915/gem: Do not leak siblings[] on proto context error Date: Thu, 30 Jul 2026 16:11:52 +0200 Message-ID: <20260730141453.628770896@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260730141444.267951807@linuxfoundation.org> References: <20260730141444.267951807@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joonas Lahtinen commit eed3de2acf6aa5154d49098b026710b646db67ee upstream. After a successful BALANCE/PARALLEL_SUBMIT extension on context creation, error during processing of next user extension leaks the siblings[] array. Fix that. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") Cc: Faith Ekstrand Cc: Simona Vetter Cc: Tvrtko Ursulin Cc: Maarten Lankhorst Cc: # v5.15+ Signed-off-by: Joonas Lahtinen Reviewed-by: Maarten Lankhorst Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260701073030.44850-1-joonas.lahtinen@linux.intel.com (cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff) Signed-off-by: Rodrigo Vivi Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/i915/gem/i915_gem_context.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) --- a/drivers/gpu/drm/i915/gem/i915_gem_context.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c @@ -769,8 +769,8 @@ static int set_proto_ctx_engines(struct struct intel_engine_cs *engine; if (copy_from_user(&ci, &user->engines[n], sizeof(ci))) { - kfree(set.engines); - return -EFAULT; + err = -EFAULT; + goto err; } memset(&set.engines[n], 0, sizeof(set.engines[n])); @@ -786,8 +786,8 @@ static int set_proto_ctx_engines(struct drm_dbg(&i915->drm, "Invalid engine[%d]: { class:%d, instance:%d }\n", n, ci.engine_class, ci.engine_instance); - kfree(set.engines); - return -ENOENT; + err = -ENOENT; + goto err; } set.engines[n].type = I915_GEM_ENGINE_TYPE_PHYSICAL; @@ -800,15 +800,21 @@ static int set_proto_ctx_engines(struct set_proto_ctx_engines_extensions, ARRAY_SIZE(set_proto_ctx_engines_extensions), &set); - if (err) { - kfree(set.engines); - return err; - } + if (err) + goto err_extensions; pc->num_user_engines = set.num_engines; pc->user_engines = set.engines; return 0; + +err_extensions: + for (n = 0; n < set.num_engines; n++) + kfree(set.engines[n].siblings); +err: + kfree(set.engines); + + return err; } static int set_proto_ctx_sseu(struct drm_i915_file_private *fpriv,