From: Jani Nikula jani.nikula@intel.com

mainline inclusion from mainline-v6.10-rc4 commit 38e3825631b1f314b21e3ade00b5a4d737eb054e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACV3A CVE: CVE-2024-40932

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

----------------------------------

The duplicated EDID is never freed. Fix it.

Cc: stable@vger.kernel.org Signed-off-by: Jani Nikula jani.nikula@intel.com Signed-off-by: Inki Dae inki.dae@samsung.com Signed-off-by: liwei liwei728@huawei.com --- drivers/gpu/drm/exynos/exynos_drm_vidi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c index fb941a8c99f0..e17f9c5c9c90 100644 --- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c +++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c @@ -309,6 +309,7 @@ static int vidi_get_modes(struct drm_connector *connector) struct vidi_context *ctx = ctx_from_connector(connector); struct edid *edid; int edid_len; + int count;

/* * the edid data comes from user side and it would be set @@ -328,7 +329,11 @@ static int vidi_get_modes(struct drm_connector *connector)

drm_connector_update_edid_property(connector, edid);

- return drm_add_edid_modes(connector, edid); + count = drm_add_edid_modes(connector, edid); + + kfree(edid); + + return count; }

static const struct drm_connector_helper_funcs vidi_connector_helper_funcs = {