drm: use after free in drm_queue_vblank_event()

PATCH New Dan Carpenter 1 participant 1 message Dec 9, 2010

Subsystems (3)

DRM drivers DRM misc Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2010-12-09 05:35 UTC #0 lore raw

PATCH 1/1 drm: use after free in drm_queue_vblank_event()

The "e" pointer is either NULL or freed when we call drm_vblank_put(dev, e->pipe) on the error path. Just pass the "pipe" variable directly instead.

I changed another caller to use "pipe" as well for consistency.

Signed-off-by Dan Carpenter <[email protected]>

drivers/gpu/drm/drm_irq.c +2 -2

index 722700d..16d5155 100644
@@ -628,7 +628,7 @@ static int drm_queue_vblank_event(struct drm_device *dev, int pipe,
 	if ((seq - vblwait->request.sequence) <= (1 << 23)) {
 		e->event.tv_sec = now.tv_sec;
 		e->event.tv_usec = now.tv_usec;
-		drm_vblank_put(dev, e->pipe);
+		drm_vblank_put(dev, pipe);
 		list_add_tail(&e->base.link, &e->base.file_priv->event_list);
 		wake_up_interruptible(&e->base.file_priv->event_wait);
 		trace_drm_vblank_event_delivered(current->pid, pipe,

@@ -645,7 +645,7 @@ err_unlock:
 	spin_unlock_irqrestore(&dev->event_lock, flags);
 	kfree(e);
 err_put:
-	drm_vblank_put(dev, e->pipe);
+	drm_vblank_put(dev, pipe);
 	return ret;
 }