Skip to contentSkip to conversation

drm/gma500: double free in psbfb_create()

PATCH In review Dan Carpenter 2 participants 2 messages Mar 19, 2015

Subsystems (4)
DRM drivers DRM misc Kernel janitors DRM drivers for GMA500 (Poulsbo, Moorestown and derivative chipsets)
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 drm/gma500: double free in psbfb_create()

The psb_gtt_free_range() frees "backing" so calling it twice is a double free bug. I have fixed this by removing the first call.

Fixes 4d8d096e9ae8 ('gma500: introduce the framebuffer support code')
Signed-off-by Dan Carpenter <[email protected]>
drivers/gpu/drm/gma500/framebuffer.c +1 -3
index 2d42ce6..89d5646 100644
@@ -479,9 +479,7 @@ static int psbfb_create(struct psb_fbdev *fbdev,
 	mutex_unlock(&dev->struct_mutex);
 	return 0;
 out_unref:
-	if (backing->stolen)
-		psb_gtt_free_range(dev, backing);
-	else
+	if (!backing->stolen)
 		drm_gem_object_unreference(&backing->gem);
 out_err1:
 	mutex_unlock(&dev->struct_mutex);