From: Andrzej Pietrasiewicz <andrzej.p@collabora•com>
To: dri-devel@lists•freedsktop.org
Cc: Maarten Lankhorst <maarten.lankhorst@linux•intel.com>,
Maxime Ripard <mripard@kernel•org>,
Thomas Zimmermann <tzimmermann@suse•de>,
David Airlie <airlied@linux•ie>, Daniel Vetter <daniel@ffwll•ch>,
James Qian Wang <james.qian.wang@arm•com>,
"Gustavo A . R . Silva" <gustavo@embeddedor•com>,
linux-next@vger•kernel.org,
Emil Velikov <emil.velikov@collabora•com>,
kernel@collabora•com
Subject: [PATCH] drm: Don't free a struct never allocated by drm_gem_fb_init()
Date: Wed, 15 Apr 2020 19:19:01 +0200 [thread overview]
Message-ID: <20200415171901.23914-1-andrzej.p@collabora.com> (raw)
In-Reply-To: <202004150853.FD574CDD@keescook>
drm_gem_fb_init() is passed the fb and never allocates it, so it should be
not the one freeing it. As it is now the second call to kfree() is possible
with the same fb. Coverity reported the following:
*** CID 1492613: Memory - corruptions (USE_AFTER_FREE)
/drivers/gpu/drm/drm_gem_framebuffer_helper.c: 230 in drm_gem_fb_create_with_funcs()
224 fb = kzalloc(sizeof(*fb), GFP_KERNEL);
225 if (!fb)
226 return ERR_PTR(-ENOMEM);
227
228 ret = drm_gem_fb_init_with_funcs(dev, fb, file, mode_cmd, funcs);
229 if (ret) {
vvv CID 1492613: Memory - corruptions (USE_AFTER_FREE)
vvv Calling "kfree" frees pointer "fb" which has already been freed. [Note: The source code implementation of the function has been overridden by a user model.]
230 kfree(fb);
231 return ERR_PTR(ret);
232 }
233
234 return fb;
235 }
drm_gem_fb_init_with_funcs() calls drm_gem_fb_init()
drm_gem_fb_init() calls kfree(fb)
Reported-by: coverity-bot <keescook+coverity-bot@chromium•org>
Addresses-Coverity-ID: 1492613 ("Memory - corruptions")
Fixes: f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer")
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora•com>
---
drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem_framebuffer_helper.c b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
index cac15294aef6..ccc2c71fa491 100644
--- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c
+++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
@@ -76,10 +76,8 @@ drm_gem_fb_init(struct drm_device *dev,
fb->obj[i] = obj[i];
ret = drm_framebuffer_init(dev, fb, funcs);
- if (ret) {
+ if (ret)
drm_err(dev, "Failed to init framebuffer: %d\n", ret);
- kfree(fb);
- }
return ret;
}
--
2.17.1
next prev parent reply other threads:[~2020-04-15 17:19 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-15 15:54 Coverity: drm_gem_fb_create_with_funcs(): Memory - corruptions coverity-bot
2020-04-15 17:19 ` Andrzej Pietrasiewicz [this message]
2020-04-15 18:33 ` [PATCH] drm: Don't free a struct never allocated by drm_gem_fb_init() Daniel Vetter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200415171901.23914-1-andrzej.p@collabora.com \
--to=andrzej.p@collabora$(echo .)com \
--cc=airlied@linux$(echo .)ie \
--cc=daniel@ffwll$(echo .)ch \
--cc=dri-devel@lists$(echo .)freedsktop.org \
--cc=emil.velikov@collabora$(echo .)com \
--cc=gustavo@embeddedor$(echo .)com \
--cc=james.qian.wang@arm$(echo .)com \
--cc=kernel@collabora$(echo .)com \
--cc=linux-next@vger$(echo .)kernel.org \
--cc=maarten.lankhorst@linux$(echo .)intel.com \
--cc=mripard@kernel$(echo .)org \
--cc=tzimmermann@suse$(echo .)de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox