Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f7b83b90 authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Dave Airlie
Browse files

drm/edid: Fix potential memory leak in edid_load() 



Do not leak memory by updating pointer with potentially
NULL realloc return value.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Reviewed-by: default avatarCarsten Emde <C.Emde@osadl.org>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent 959f7247

drivers/gpu/drm/drm_edid_load.c

+5 −3
Original line number Diff line number Diff line
@@ -119,7 +119,7 @@ static int edid_load(struct drm_connector *connector, char *name, 
{

	const struct firmware *fw;

	struct platform_device *pdev;

	u8 *fwdata = NULL, *edid;

	u8 *fwdata = NULL, *edid, *new_edid;

	int fwsize, expected;

	int builtin = 0, err = 0;

	int i, valid_extensions = 0;
@@ -195,12 +195,14 @@ static int edid_load(struct drm_connector *connector, char *name, 
		    "\"%s\" for connector \"%s\"\n", valid_extensions,

		    edid[0x7e], name, connector_name);

		edid[0x7e] = valid_extensions;

		edid = krealloc(edid, (valid_extensions + 1) * EDID_LENGTH,

		new_edid = krealloc(edid, (valid_extensions + 1) * EDID_LENGTH,

		    GFP_KERNEL);

		if (edid == NULL) {

		if (new_edid == NULL) {

			err = -ENOMEM;

			kfree(edid);

			goto relfw_out;

		}

		edid = new_edid;

	}



	connector->display_info.raw_edid = edid;