Skip to content

Commit ab244be

Browse files
tititiou36Lyude
authored andcommitted
drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name()
If successful ida_simple_get() calls are not undone when needed, some additional memory may be allocated and wasted. Here, an ID between 0 and MAX_INT is required. If this ID is >=100, it is not taken into account and is wasted. It should be released. Instead of calling ida_simple_remove(), take advantage of the 'max' parameter to require the ID not to be too big. Should it be too big, it is not allocated and don't need to be freed. While at it, use ida_alloc_xxx()/ida_free() instead to ida_simple_get()/ida_simple_remove(). The latter is deprecated and more verbose. Fixes: db1a0ae ("drm/nouveau/bl: Assign different names to interfaces") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Reviewed-by: Lyude Paul <lyude@redhat.com> [Fixed formatting warning from checkpatch] Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/9ba85bca59df6813dc029e743a836451d5173221.1644386541.git.christophe.jaillet@wanadoo.fr
1 parent 87fd2b0 commit ab244be

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

drivers/gpu/drm/nouveau/nouveau_backlight.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,9 @@ static bool
4646
nouveau_get_backlight_name(char backlight_name[BL_NAME_SIZE],
4747
struct nouveau_backlight *bl)
4848
{
49-
const int nb = ida_simple_get(&bl_ida, 0, 0, GFP_KERNEL);
50-
if (nb < 0 || nb >= 100)
49+
const int nb = ida_alloc_max(&bl_ida, 99, GFP_KERNEL);
50+
51+
if (nb < 0)
5152
return false;
5253
if (nb > 0)
5354
snprintf(backlight_name, BL_NAME_SIZE, "nv_backlight%d", nb);
@@ -414,7 +415,7 @@ nouveau_backlight_init(struct drm_connector *connector)
414415
nv_encoder, ops, &props);
415416
if (IS_ERR(bl->dev)) {
416417
if (bl->id >= 0)
417-
ida_simple_remove(&bl_ida, bl->id);
418+
ida_free(&bl_ida, bl->id);
418419
ret = PTR_ERR(bl->dev);
419420
goto fail_alloc;
420421
}
@@ -442,7 +443,7 @@ nouveau_backlight_fini(struct drm_connector *connector)
442443
return;
443444

444445
if (bl->id >= 0)
445-
ida_simple_remove(&bl_ida, bl->id);
446+
ida_free(&bl_ida, bl->id);
446447

447448
backlight_device_unregister(bl->dev);
448449
nv_conn->backlight = NULL;

0 commit comments

Comments
 (0)