lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAMeQTsYon84hjPfhvsVXEGc6q9D0jsjXpaYyaMHY8ezAJWe=FQ@mail.gmail.com> Date: Wed, 7 Oct 2015 22:55:23 +0200 From: Patrik Jakobsson <patrik.r.jakobsson@...il.com> To: Sudip Mukherjee <sudipm.mukherjee@...il.com> Cc: David Airlie <airlied@...ux.ie>, linux-kernel <linux-kernel@...r.kernel.org>, Daniel Vetter <daniel.vetter@...ll.ch>, dri-devel <dri-devel@...ts.freedesktop.org> Subject: Re: [PATCH v2] drm/gma500: fix double freeing On Tue, Oct 6, 2015 at 5:48 PM, Sudip Mukherjee <sudipm.mukherjee@...il.com> wrote: > We are allocating backing using psbfb_alloc() and so > backing->stolen is always true. So we were freeing backing two times. > Moreover if we follow the execution path then we should be freeing > backing after we have released the helper. So remove the one which frees > backing before the helper is released. > While at it the error labels are also renamed to give a meaningful > name. > > Cc: Patrik Jakobsson <patrik.r.jakobsson@...il.com> > Signed-off-by: Sudip Mukherjee <sudip@...torindia.org> > --- > > Hi Patrik, > If you donot like the labels I will change them according to what you > have suggested. Hi Label names are used in all sorts of funny ways in the kernel. However CodingStyle is quite clear on the matter: "Also don't name them after the goto location like "err_kmalloc_failed:" and if you think about it, it makes sense. Let's say we add another goto to that label then the name wouldn't be correct anymore. err_release and err_unlock would make me happier :) With that fixed Reviewed-by: Patrik Jakobsson <patrik.r.jakobsson@...il.com> Thanks > drivers/gpu/drm/gma500/framebuffer.c | 13 ++++--------- > 1 file changed, 4 insertions(+), 9 deletions(-) > > diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c > index 2eaf1b3..52e2bf3 100644 > --- a/drivers/gpu/drm/gma500/framebuffer.c > +++ b/drivers/gpu/drm/gma500/framebuffer.c > @@ -411,7 +411,7 @@ static int psbfb_create(struct psb_fbdev *fbdev, > info = drm_fb_helper_alloc_fbi(&fbdev->psb_fb_helper); > if (IS_ERR(info)) { > ret = PTR_ERR(info); > - goto out_err1; > + goto err_alloc_fbi; > } > info->par = fbdev; > > @@ -419,7 +419,7 @@ static int psbfb_create(struct psb_fbdev *fbdev, > > ret = psb_framebuffer_init(dev, psbfb, &mode_cmd, backing); > if (ret) > - goto out_unref; > + goto err_framebuffer_init; > > fb = &psbfb->base; > psbfb->fbdev = info; > @@ -465,14 +465,9 @@ static int psbfb_create(struct psb_fbdev *fbdev, > > mutex_unlock(&dev->struct_mutex); > return 0; > -out_unref: > - if (backing->stolen) > - psb_gtt_free_range(dev, backing); > - else > - drm_gem_object_unreference(&backing->gem); > - > +err_framebuffer_init: > drm_fb_helper_release_fbi(&fbdev->psb_fb_helper); > -out_err1: > +err_alloc_fbi: > mutex_unlock(&dev->struct_mutex); > psb_gtt_free_range(dev, backing); > return ret; > -- > 1.9.1 > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists