Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f48bb04a authored by Julia Lawall's avatar Julia Lawall Committed by Dave Airlie
Browse files

drivers/gpu/drm/radeon/radeon_cs.c: eliminate possible double free 



The function radeon_cs_parser_init is only called from two places, in
drivers/gpu/drm/radeon/radeon_cs.c and drivers/gpu/drm/radeon/r600_cs.c.
In each case, if the call fails another function is called that frees all
of the kdata and dpage information in the chunks array.  So this
information should not be freed in radeon_cs_parser_init as well.

Signed-off-by: default avatarJulia Lawall <Julia.Lawall@lip6.fr>
Reviewed-by: default avatarJerome Glisse <jglisse@redhat.com>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent abc8113f

drivers/gpu/drm/radeon/radeon_cs.c

+2 −14
Original line number Diff line number Diff line
@@ -243,20 +243,11 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data) 
	if ((p->cs_flags & RADEON_CS_USE_VM) &&

	    !p->rdev->vm_manager.enabled) {

		DRM_ERROR("VM not active on asic!\n");

		if (p->chunk_relocs_idx != -1)

			kfree(p->chunks[p->chunk_relocs_idx].kdata);

		if (p->chunk_flags_idx != -1)

			kfree(p->chunks[p->chunk_flags_idx].kdata);

		return -EINVAL;

	}



	if (radeon_cs_get_ring(p, ring, priority)) {

		if (p->chunk_relocs_idx != -1)

			kfree(p->chunks[p->chunk_relocs_idx].kdata);

		if (p->chunk_flags_idx != -1)

			kfree(p->chunks[p->chunk_flags_idx].kdata);

	if (radeon_cs_get_ring(p, ring, priority))

		return -EINVAL;

	}





	/* deal with non-vm */
@@ -271,11 +262,8 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data) 
		p->chunks[p->chunk_ib_idx].kpage[0] = kmalloc(PAGE_SIZE, GFP_KERNEL);

		p->chunks[p->chunk_ib_idx].kpage[1] = kmalloc(PAGE_SIZE, GFP_KERNEL);

		if (p->chunks[p->chunk_ib_idx].kpage[0] == NULL ||

		    p->chunks[p->chunk_ib_idx].kpage[1] == NULL) {

			kfree(p->chunks[p->chunk_ib_idx].kpage[0]);

			kfree(p->chunks[p->chunk_ib_idx].kpage[1]);

		    p->chunks[p->chunk_ib_idx].kpage[1] == NULL)

			return -ENOMEM;

		}

		p->chunks[p->chunk_ib_idx].kpage_idx[0] = -1;

		p->chunks[p->chunk_ib_idx].kpage_idx[1] = -1;

		p->chunks[p->chunk_ib_idx].last_copied_page = -1;