Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cf19fa2c authored by Noralf Trønnes's avatar Noralf Trønnes
Browse files

drm/client: Fix double free in error path 



This fixes a static checker warning:

	drivers/gpu/drm/drm_client.c:289 drm_client_buffer_create()
	error: double free of 'buffer'

Extend drm_client_buffer_delete() to handle the case when there's no
dumb buffer attached and drop the extra kfree.

Fixes: c76f0f7c ("drm: Begin an API for in-kernel clients")
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: default avatarNoralf Trønnes <noralf@tronnes.org>
Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20180712150414.46908-1-noralf@tronnes.org
parent a08eac47

drivers/gpu/drm/drm_client.c

+4 −4
Original line number Diff line number Diff line
@@ -218,7 +218,9 @@ static void drm_client_buffer_delete(struct drm_client_buffer *buffer) 
	if (buffer->gem)

		drm_gem_object_put_unlocked(buffer->gem);



	if (buffer->handle)

		drm_mode_destroy_dumb(dev, buffer->handle, buffer->client->file);



	kfree(buffer);

}
@@ -243,7 +245,7 @@ drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height, u 
	dumb_args.bpp = drm_format_plane_cpp(format, 0) * 8;

	ret = drm_mode_create_dumb(dev, &dumb_args, client->file);

	if (ret)

		goto err_free;

		goto err_delete;



	buffer->handle = dumb_args.handle;

	buffer->pitch = dumb_args.pitch;
@@ -276,8 +278,6 @@ drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height, u 


err_delete:

	drm_client_buffer_delete(buffer);

err_free:

	kfree(buffer);



	return ERR_PTR(ret);

}