Commit ad45aa9e authored Feb 09, 2009 by Chris Wilson Committed by Dave Airlie Feb 20, 2009

drm: Potential use-after-free on error path.



Remove the member from the hash table before we free the structure!

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@linux.ie>

parent 005568be

drivers/gpu/drm/drm_gem.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -104,8 +104,8 @@ drm_gem_init(struct drm_device *dev)

		if (drm_mm_init(&mm->offset_manager, DRM_FILE_PAGE_OFFSET_START,
		DRM_FILE_PAGE_OFFSET_SIZE)) {
		drm_free(mm, sizeof(struct drm_gem_mm), DRM_MEM_MM);
		drm_ht_remove(&mm->offset_hash);
		drm_free(mm, sizeof(struct drm_gem_mm), DRM_MEM_MM);
		return -ENOMEM;
		}