| Message ID | 1344342186-6561-1-git-send-email-khoroshilov@ispras.ru (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 08/07/2012 02:23 PM, Alexey Khoroshilov wrote: > Do not leak memory by updating pointer with potentially > NULL realloc return value. > > Found by Linux Driver Verification project (linuxtesting.org). Thanks, Alexey! Reviewed-by: Carsten Emde <C.Emde@osadl.org> > Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> > --- > drivers/gpu/drm/drm_edid_load.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/drm_edid_load.c b/drivers/gpu/drm/drm_edid_load.c > index 66d4a28..0303935 100644 > --- a/drivers/gpu/drm/drm_edid_load.c > +++ b/drivers/gpu/drm/drm_edid_load.c > @@ -119,7 +119,7 @@ static int edid_load(struct drm_connector *connector, char *name, > { > const struct firmware *fw; > struct platform_device *pdev; > - u8 *fwdata = NULL, *edid; > + u8 *fwdata = NULL, *edid, *new_edid; > int fwsize, expected; > int builtin = 0, err = 0; > int i, valid_extensions = 0; > @@ -195,12 +195,14 @@ static int edid_load(struct drm_connector *connector, char *name, > "\"%s\" for connector \"%s\"\n", valid_extensions, > edid[0x7e], name, connector_name); > edid[0x7e] = valid_extensions; > - edid = krealloc(edid, (valid_extensions + 1) * EDID_LENGTH, > + new_edid = krealloc(edid, (valid_extensions + 1) * EDID_LENGTH, > GFP_KERNEL); > - if (edid == NULL) { > + if (new_edid == NULL) { > err = -ENOMEM; > + kfree(edid); > goto relfw_out; > } > + edid = new_edid; > } > > connector->display_info.raw_edid = edid;
diff --git a/drivers/gpu/drm/drm_edid_load.c b/drivers/gpu/drm/drm_edid_load.c index 66d4a28..0303935 100644 --- a/drivers/gpu/drm/drm_edid_load.c +++ b/drivers/gpu/drm/drm_edid_load.c @@ -119,7 +119,7 @@ static int edid_load(struct drm_connector *connector, char *name, { const struct firmware *fw; struct platform_device *pdev; - u8 *fwdata = NULL, *edid; + u8 *fwdata = NULL, *edid, *new_edid; int fwsize, expected; int builtin = 0, err = 0; int i, valid_extensions = 0; @@ -195,12 +195,14 @@ static int edid_load(struct drm_connector *connector, char *name, "\"%s\" for connector \"%s\"\n", valid_extensions, edid[0x7e], name, connector_name); edid[0x7e] = valid_extensions; - edid = krealloc(edid, (valid_extensions + 1) * EDID_LENGTH, + new_edid = krealloc(edid, (valid_extensions + 1) * EDID_LENGTH, GFP_KERNEL); - if (edid == NULL) { + if (new_edid == NULL) { err = -ENOMEM; + kfree(edid); goto relfw_out; } + edid = new_edid; } connector->display_info.raw_edid = edid;
Do not leak memory by updating pointer with potentially NULL realloc return value. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> --- drivers/gpu/drm/drm_edid_load.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)