From: Ulrich Obergfell <uobergfe@xxxxxxxxxx> Commit 24b102d3488c9d201915d070a519e07098e0cd30 modified nouveau to take a copy of the data returned by acpi_video_get_edid() to prevent an invalid free later on. This left a leak of the acpi_buffer. A correct fix involves modifying the ACPI code to return a copy of the EDID data, and freeing the acpi_buffer. Signed-off-by: Ulrich Obergfell <uobergfe@xxxxxxxxxx> Signed-off-by: Ben Skeggs <bskeggs@xxxxxxxxxx> --- drivers/acpi/video.c | 8 ++++++-- drivers/gpu/drm/nouveau/nouveau_acpi.c | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c index 31e9e10..e63ab12 100644 --- a/drivers/acpi/video.c +++ b/drivers/acpi/video.c @@ -1332,8 +1332,12 @@ int acpi_video_get_edid(struct acpi_device *device, int type, int device_id, } } - *edid = buffer->buffer.pointer; - return length; + *edid = kmemdup(buffer->buffer.pointer, buffer->buffer.length, GFP_KERNEL); + kfree(buffer); + if (*edid) + return length; + else + return -ENOMEM; } return -ENODEV; diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c index a542380..2d51a38 100644 --- a/drivers/gpu/drm/nouveau/nouveau_acpi.c +++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c @@ -297,6 +297,6 @@ nouveau_acpi_edid(struct drm_device *dev, struct drm_connector *connector) if (ret < 0) return ret; - nv_connector->edid = kmemdup(edid, EDID_LENGTH, GFP_KERNEL); + nv_connector->edid = edid; return 0; } -- 1.7.4.2 -- To unsubscribe from this list: send the line "unsubscribe linux-acpi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
