Executive brief
The Linux kernel's Sitronix ST7701 display panel driver failed to properly clean up memory when the MIPI DSI attachment process failed during device initialization. This memory leak could accumulate over multiple failed device attachments, gradually consuming system memory and potentially leading to denial of service on systems using this display panel.
Technical details
This is a resource management vulnerability in the DRM (Direct Rendering Manager) panel driver for the Sitronix ST7701 display controller. The vulnerable code in st7701_dsi_probe() called mipi_dsi_attach() but did not invoke the required cleanup function drm_panel_remove() if the attachment failed. The fix adds proper error handling that calls drm_panel_remove() before returning the error code, ensuring allocated panel resources are freed. This is a local vulnerability requiring kernel-level access to trigger the failure condition. The impact is a kernel memory leak that accumulates with each failed DSI attachment attempt, potentially enabling denial of service.
Affected products
- Linux Linux kernel Affected versions prior to patch (commit c62102165dd79284d42383d2f7ed17301bd8e629)
Timeline
- 2022-10-15: disclosed
- 2022-10-15: patched