From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 05C91175A6B; Mon, 17 Aug 2026 14:30:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786977034; cv=none; b=mOByeohOtpgivz648C4k8KmWIltzqbh63WDL6noFBgPMc48kLGqnrQejOmehMFys5P5anUM0XoqJLvhe3H823qr9JAaUa0OUHk09D9nSaMxodZLHdgp9R9CsZwSRpAZjwW0cfcZ+rHemQPK+I2DcK9uu4bgqdegV+WdSk1GHYvI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786977034; c=relaxed/simple; bh=jJGiZ1pSFTFBEasTIOYS4HYY7xrAqJdwDq9/s7EJZKg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ld3No55eVtvmGSzaue2OeXqwGxlcwixAx2SqPc9DD56Yr1kTzJZMoCW9bHTEWo0XSYdEE7AxSCsxcAL+Yhq6Gz60phTITyUQzISweBQNO11sA3EMihMzEiMk6AIKne4F6bcHLiboRDsCUIUyxPJ7Vn4xNJ32Qlvwe8JU4w0chWQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ca46HKkq; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ca46HKkq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34BBD1F000E9; Mon, 17 Aug 2026 14:30:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786977032; bh=R3R0h3YRY4Mmo66rL94mj8hGeUZVjvh5wMx6M09nPbU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ca46HKkqNH+xpAEPI27HT0i0TkT5Ji9rOja3JiR9ibqDSkIbqknUC8TEk2yFNk7sT i0+FPONcUNUdm9ZmFzD7ne6m31whiCfxGcLv2Lsruk8WyfMLhgG0R0gYRC+z9nA5gD qu2sYwWf6wOkTfWWt7kxJlhY/DcA3q1+zvOJeDts= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Martin Hodo , Faith Ekstrand , Simona Vetter , Tvrtko Ursulin , Maarten Lankhorst , Joonas Lahtinen , Tvrtko Ursulin , Rodrigo Vivi Subject: [PATCH 5.15 149/456] drm/i915/gem: Do not leak siblings[] on proto context error Date: Mon, 17 Aug 2026 15:28:59 +0200 Message-ID: <20260817132545.901003473@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132539.792407575@linuxfoundation.org> References: <20260817132539.792407575@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joonas Lahtinen commit eed3de2acf6aa5154d49098b026710b646db67ee upstream. After a successful BALANCE/PARALLEL_SUBMIT extension on context creation, error during processing of next user extension leaks the siblings[] array. Fix that. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") Cc: Faith Ekstrand Cc: Simona Vetter Cc: Tvrtko Ursulin Cc: Maarten Lankhorst Cc: # v5.15+ Signed-off-by: Joonas Lahtinen Reviewed-by: Maarten Lankhorst Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260701073030.44850-1-joonas.lahtinen@linux.intel.com (cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff) Signed-off-by: Rodrigo Vivi Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/i915/gem/i915_gem_context.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) --- a/drivers/gpu/drm/i915/gem/i915_gem_context.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c @@ -565,8 +565,8 @@ static int set_proto_ctx_engines(struct struct intel_engine_cs *engine; if (copy_from_user(&ci, &user->engines[n], sizeof(ci))) { - kfree(set.engines); - return -EFAULT; + err = -EFAULT; + goto err; } memset(&set.engines[n], 0, sizeof(set.engines[n])); @@ -582,8 +582,8 @@ static int set_proto_ctx_engines(struct drm_dbg(&i915->drm, "Invalid engine[%d]: { class:%d, instance:%d }\n", n, ci.engine_class, ci.engine_instance); - kfree(set.engines); - return -ENOENT; + err = -ENOENT; + goto err; } set.engines[n].type = I915_GEM_ENGINE_TYPE_PHYSICAL; @@ -596,15 +596,21 @@ static int set_proto_ctx_engines(struct set_proto_ctx_engines_extensions, ARRAY_SIZE(set_proto_ctx_engines_extensions), &set); - if (err) { - kfree(set.engines); - return err; - } + if (err) + goto err_extensions; pc->num_user_engines = set.num_engines; pc->user_engines = set.engines; return 0; + +err_extensions: + for (n = 0; n < set.num_engines; n++) + kfree(set.engines[n].siblings); +err: + kfree(set.engines); + + return err; } static int set_proto_ctx_sseu(struct drm_i915_file_private *fpriv,