Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 925e4940 authored by Tomi Valkeinen's avatar Tomi Valkeinen
Browse files

drm/omap: fix error handling in omap_framebuffer_create() 



When an error happens in omap_framebuffer_create(),
omap_framebuffer_create() calls omap_framebuffer_destroy() if the fb
struct has been allocated. However, that crashes, as
omap_framebuffer_destroy(), which calls drm_framebuffer_cleanup(),
should only be called after drm_framebuffer_init()

Fix this by just calling kfree() for the allocated fb when an error
happens.

Signed-off-by: default avatarTomi Valkeinen <tomi.valkeinen@ti.com>
parent c7c1aecd

drivers/gpu/drm/omapdrm/omap_fb.c

+2 −3
Original line number Diff line number Diff line
@@ -380,7 +380,7 @@ struct drm_framebuffer *omap_framebuffer_create(struct drm_device *dev, 
struct drm_framebuffer *omap_framebuffer_init(struct drm_device *dev,

		struct drm_mode_fb_cmd2 *mode_cmd, struct drm_gem_object **bos)

{

	struct omap_framebuffer *omap_fb;

	struct omap_framebuffer *omap_fb = NULL;

	struct drm_framebuffer *fb = NULL;

	const struct format *format = NULL;

	int ret, i, n = drm_format_num_planes(mode_cmd->pixel_format);
@@ -451,8 +451,7 @@ struct drm_framebuffer *omap_framebuffer_init(struct drm_device *dev, 
	return fb;



fail:

	if (fb)

		omap_framebuffer_destroy(fb);

	kfree(omap_fb);



	return ERR_PTR(ret);

}