Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6f331623 authored by Dan Carpenter's avatar Dan Carpenter Committed by Dave Airlie
Browse files

drm: use after free in drm_queue_vblank_event() 



The "e" pointer is either NULL or freed when we call
drm_vblank_put(dev, e->pipe) on the error path.  Just pass the "pipe"
variable directly instead.

I changed another caller to use "pipe" as well for consistency.

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent e76116ca

drivers/gpu/drm/drm_irq.c

+2 −2
Original line number Diff line number Diff line
@@ -628,7 +628,7 @@ static int drm_queue_vblank_event(struct drm_device *dev, int pipe, 
	if ((seq - vblwait->request.sequence) <= (1 << 23)) {

		e->event.tv_sec = now.tv_sec;

		e->event.tv_usec = now.tv_usec;

		drm_vblank_put(dev, e->pipe);

		drm_vblank_put(dev, pipe);

		list_add_tail(&e->base.link, &e->base.file_priv->event_list);

		wake_up_interruptible(&e->base.file_priv->event_wait);

		trace_drm_vblank_event_delivered(current->pid, pipe,
@@ -645,7 +645,7 @@ static int drm_queue_vblank_event(struct drm_device *dev, int pipe, 
	spin_unlock_irqrestore(&dev->event_lock, flags);

	kfree(e);

err_put:

	drm_vblank_put(dev, e->pipe);

	drm_vblank_put(dev, pipe);

	return ret;

}