8 Dec
2023
8 Dec
'23
9:23 a.m.
On Fri, 21 Jul 2023 09:14:46 -0700, Ziqi Zhao wrote:
The connector_set contains uninitialized values when allocated with kmalloc_array. However, in the "out" branch, the logic assumes that any element in connector_set would be equal to NULL if failed to initialize, which causes the bug reported by Syzbot. The fix is to use an extra variable to keep track of how many connectors are initialized indeed, and use that variable to decrease any refcounts in the "out" branch.
[...]
Applied to drm/drm-misc (drm-misc-fixes).
Thanks! Maxime