Skip to contentSkip to conversation

Coverity: drm_gem_fb_create_with_funcs(): Memory - corruptions

PATCH In review coverity-bot 3 participants 4 messages Apr 15, 2020 – Apr 16, 2020

Subsystems (3)
DRM drivers DRM misc Linux-next tree
lore
Share & tools
lore

coverity-bot

author
#0 lore raw

Hello!

This is an experimental semi-automated report about issues detected by Coverity from a scan of next-20200415 as part of the linux-next scan project:
https://scan.coverity.com/projects/linux-next-weekly-scan

You're getting this email because you were associated with the identified lines of code (noted below) that were touched by commits:

Wed Mar 11 15:55:36 2020 +0100
f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer")

Coverity reported the following:

*** CID 1492613: Memory - corruptions (USE_AFTER_FREE) /drivers/gpu/drm/drm_gem_framebuffer_helper.c: 230 in drm_gem_fb_create_with_funcs()

224     	fb = kzalloc(sizeof(*fb), GFP_KERNEL);
225     	if (!fb)
226     		return ERR_PTR(-ENOMEM);
227
228     	ret = drm_gem_fb_init_with_funcs(dev, fb, file, mode_cmd, funcs);
229     	if (ret) {
vvv     CID 1492613:  Memory - corruptions  (USE_AFTER_FREE)
vvv     Calling "kfree" frees pointer "fb" which has already been freed. [Note: The source code implementation of the function has been overridden by a user model.]
230     		kfree(fb);
231     		return ERR_PTR(ret);
232     	}

233
234 return fb;
235 }

If this is a false positive, please let us know so we can mark it as such, or teach the Coverity rules to be smarter. If not, please make sure fixes get into linux-next. :) For patches fixing this, please include these lines (but double-check the "Fixes" first):

Edit by human, double checking context:
drm_gem_fb_init_with_funcs() calls drm_gem_fb_init() drm_gem_fb_init() calls kfree(fb)

Reported-by coverity-bot <[email protected]>

Addresses-Coverity-ID: 1492613 ("Memory - corruptions")

Fixes f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer")

Thanks for your attention!

Signature · 1 line
Coverity-bot
#1 lore raw

PATCH 1/1 drm: Don't free a struct never allocated by drm_gem_fb_init()

drm_gem_fb_init() is passed the fb and never allocates it, so it should be not the one freeing it. As it is now the second call to kfree() is possible with the same fb. Coverity reported the following:

*** CID 1492613: Memory - corruptions (USE_AFTER_FREE) /drivers/gpu/drm/drm_gem_framebuffer_helper.c: 230 in drm_gem_fb_create_with_funcs()

224     	fb = kzalloc(sizeof(*fb), GFP_KERNEL);
225     	if (!fb)
226     		return ERR_PTR(-ENOMEM);
227
228     	ret = drm_gem_fb_init_with_funcs(dev, fb, file, mode_cmd, funcs);
229     	if (ret) {
vvv     CID 1492613:  Memory - corruptions  (USE_AFTER_FREE)
vvv     Calling "kfree" frees pointer "fb" which has already been freed. [Note: The source code implementation of the function has been overridden by a user model.]
230     		kfree(fb);
231     		return ERR_PTR(ret);
232     	}

233
234 return fb;
235 }

drm_gem_fb_init_with_funcs() calls drm_gem_fb_init() drm_gem_fb_init() calls kfree(fb)

Reported-by coverity-bot <[email protected]>

Addresses-Coverity-ID: 1492613 ("Memory - corruptions")

Fixes f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer")
Signed-off-by Andrzej Pietrasiewicz <[email protected]>
---
 drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/gpu/drm/drm_gem_framebuffer_helper.c +1 -3
index cac15294aef6..ccc2c71fa491 100644
@@ -76,10 +76,8 @@ drm_gem_fb_init(struct drm_device *dev,
 		fb->obj[i] = obj[i];
 
 	ret = drm_framebuffer_init(dev, fb, funcs);
-	if (ret) {
+	if (ret)
 		drm_err(dev, "Failed to init framebuffer: %d\n", ret);
-		kfree(fb);
-	}
 
 	return ret;
 }
Signature · 1 line
2.17.1
Reviewed-by on v1 1/1
#2 lore raw

Re: [PATCH] drm: Don't free a struct never allocated by drm_gem_fb_init()

Quoted 22 lines · Andrzej Pietrasiewicz

drm_gem_fb_init() is passed the fb and never allocates it, so it should be not the one freeing it. As it is now the second call to kfree() is possible with the same fb. Coverity reported the following:

*** CID 1492613: Memory - corruptions (USE_AFTER_FREE) /drivers/gpu/drm/drm_gem_framebuffer_helper.c: 230 in drm_gem_fb_create_with_funcs()
224 fb = kzalloc(sizeof(*fb), GFP_KERNEL);
225 if (!fb)
226 return ERR_PTR(-ENOMEM);
227
228 ret = drm_gem_fb_init_with_funcs(dev, fb, file, mode_cmd, funcs);
229 if (ret) {
vvv CID 1492613: Memory - corruptions (USE_AFTER_FREE)
vvv Calling "kfree" frees pointer "fb" which has already been freed. [Note: The source code implementation of the function has been overridden by a user model.]
230 kfree(fb);
231 return ERR_PTR(ret);
232 }
233
234 return fb;
235 }

Quoted 7 lines

drm_gem_fb_init_with_funcs() calls drm_gem_fb_init() drm_gem_fb_init() calls kfree(fb)

Reported-by coverity-bot <[email protected]>

Addresses-Coverity-ID: 1492613 ("Memory - corruptions")

Fixes f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer")
Signed-off-by Andrzej Pietrasiewicz <[email protected]>
Reviewed-by Daniel Vetter <[email protected]>
Quoted 23 lines
---
 drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/gpu/drm/drm_gem_framebuffer_helper.c +1 -4
index cac15294aef6..ccc2c71fa491 100644
@@ -76,10 +76,8 @@ drm_gem_fb_init(struct drm_device *dev,
                fb->obj[i] = obj[i];
 
        ret = drm_framebuffer_init(dev, fb, funcs);
-       if (ret) {
+       if (ret)
                drm_err(dev, "Failed to init framebuffer: %d\n", ret);
-               kfree(fb);
-       }
 
        return ret;
 }
--

2.17.1

Signature · 3 lines
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
#3 lore raw

Re: [PATCH] drm: Don't free a struct never allocated by drm_gem_fb_init()

W dniu 15.04.2020 o 20:33, Daniel Vetter pisze:

Quoted 52 lines
Quoted 22 lines · Andrzej Pietrasiewicz

drm_gem_fb_init() is passed the fb and never allocates it, so it should be not the one freeing it. As it is now the second call to kfree() is possible with the same fb. Coverity reported the following:

*** CID 1492613: Memory - corruptions (USE_AFTER_FREE) /drivers/gpu/drm/drm_gem_framebuffer_helper.c: 230 in drm_gem_fb_create_with_funcs()
224 fb = kzalloc(sizeof(*fb), GFP_KERNEL);
225 if (!fb)
226 return ERR_PTR(-ENOMEM);
227
228 ret = drm_gem_fb_init_with_funcs(dev, fb, file, mode_cmd, funcs);
229 if (ret) {
vvv CID 1492613: Memory - corruptions (USE_AFTER_FREE)
vvv Calling "kfree" frees pointer "fb" which has already been freed. [Note: The source code implementation of the function has been overridden by a user model.]
230 kfree(fb);
231 return ERR_PTR(ret);
232 }
233
234 return fb;
235 }

Quoted 7 lines

drm_gem_fb_init_with_funcs() calls drm_gem_fb_init() drm_gem_fb_init() calls kfree(fb)

Reported-by coverity-bot <[email protected]>

Addresses-Coverity-ID: 1492613 ("Memory - corruptions")

Fixes f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer")
Signed-off-by Andrzej Pietrasiewicz <[email protected]>
Reviewed-by Daniel Vetter <[email protected]>
Quoted 18 lines
---
  drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +---
  1 file changed, 1 insertion(+), 3 deletions(-)
drivers/gpu/drm/drm_gem_framebuffer_helper.c +1 -3
index cac15294aef6..ccc2c71fa491 100644
@@ -76,10 +76,8 @@ drm_gem_fb_init(struct drm_device *dev,
                 fb->obj[i] = obj[i];
 
         ret = drm_framebuffer_init(dev, fb, funcs);
-       if (ret) {
+       if (ret)
                 drm_err(dev, "Failed to init framebuffer: %d\n", ret);
-               kfree(fb);
-       }
Quoted 7 lines
Quoted 5 lines
drivers/gpu/drm/drm_gem_framebuffer_helper.c +0 -1
         return ret;
  }
--

2.17.1

_______________________________________________
dri-devel mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/dri-devel