From patchwork Thu Jan 16 03:31:45 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sachin Kamat X-Patchwork-Id: 3501201 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 2BBE59F169 for ; Fri, 17 Jan 2014 00:03:36 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 5F2CD2015E for ; Fri, 17 Jan 2014 00:03:35 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 966EF2015D for ; Fri, 17 Jan 2014 00:03:34 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 5A047105FDA; Thu, 16 Jan 2014 16:03:29 -0800 (PST) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-pd0-f172.google.com (mail-pd0-f172.google.com [209.85.192.172]) by gabe.freedesktop.org (Postfix) with ESMTP id 0E02C108216 for ; Wed, 15 Jan 2014 19:36:45 -0800 (PST) Received: by mail-pd0-f172.google.com with SMTP id z10so2006630pdj.31 for ; Wed, 15 Jan 2014 19:36:00 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=UoacltAhHCz+baAQM7fe4GAGZyRvtVdmYvBNpldj74w=; b=YhGM6HUhjGu5soil7bPCeWEZ0tkiCBm16RaaTVefYnWSNfUvjkAC4Wdjeqzo+5yNZA G7g7YJJx5z4dTyVupx2tPbXBleSoqiX20BWOy7w34iXkWWLGSskQuV2Lpt8KI4K42ZxH 7CvKdB9fIFvqcYEGuTT5Djq+N4iH8oSJFnMKNsm2AdZMIZZZPFuvaE0T2tCXU4vLUQCW htxHw9MAxszZgvQr84wzIBBeKFbjv2emY21wuFwhSOUlMYqDMmfrMfIMVoVGe56SC7Oc aH5GV4antB9T6PaK3Q5sG5vaPaC9/xvDjRqKWGkl3aLn0AYYw4erzcaooJrWC/ZwEznl zIAw== X-Gm-Message-State: ALoCoQlItHqTP1LJwRfRpJDWHzLYTvLDt/wNHkepIecx69xW6zvewLqBjngeRjNab5SqvLNWFufs X-Received: by 10.68.12.138 with SMTP id y10mr7023318pbb.101.1389843360139; Wed, 15 Jan 2014 19:36:00 -0800 (PST) Received: from linaro.sisodomain.com ([115.113.119.130]) by mx.google.com with ESMTPSA id vn10sm11459578pbc.21.2014.01.15.19.35.57 for (version=TLSv1.1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 15 Jan 2014 19:35:59 -0800 (PST) From: Sachin Kamat To: dri-devel@lists.freedesktop.org Subject: [PATCH 1/1] drm/exynos: Fix freeing issues in exynos_drm_drv.c Date: Thu, 16 Jan 2014 09:01:45 +0530 Message-Id: <1389843105-20741-1-git-send-email-sachin.kamat@linaro.org> X-Mailer: git-send-email 1.7.9.5 X-Mailman-Approved-At: Thu, 16 Jan 2014 16:02:03 -0800 Cc: sachin.kamat@linaro.org, sw0312.kim@samsung.com, patches@linaro.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: dri-devel-bounces@lists.freedesktop.org Errors-To: dri-devel-bounces@lists.freedesktop.org X-Spam-Status: No, score=-4.5 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Make 'file_priv' NULL upon freeing and add a check before dereferencing to avoid the following errors: drivers/gpu/drm/exynos/exynos_drm_drv.c:182 exynos_drm_open() error: double free of 'file_priv' drivers/gpu/drm/exynos/exynos_drm_drv.c:188 exynos_drm_open() error: dereferencing freed memory 'file_priv' Signed-off-by: Sachin Kamat --- drivers/gpu/drm/exynos/exynos_drm_drv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c index 9d096a0..ee84a7b6 100644 --- a/drivers/gpu/drm/exynos/exynos_drm_drv.c +++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c @@ -173,6 +173,7 @@ static int exynos_drm_open(struct drm_device *dev, struct drm_file *file) ret = exynos_drm_subdrv_open(dev, file); if (ret) { kfree(file_priv); + file_priv = NULL; file->driver_priv = NULL; } @@ -184,7 +185,8 @@ static int exynos_drm_open(struct drm_device *dev, struct drm_file *file) } anon_filp->f_mode = FMODE_READ | FMODE_WRITE; - file_priv->anon_filp = anon_filp; + if (file_priv) + file_priv->anon_filp = anon_filp; return ret; }