From patchwork Wed May 27 10:03:59 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Frediano Ziglio X-Patchwork-Id: 6489241 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id CBAAB9F1CC for ; Wed, 27 May 2015 11:20:05 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 0F2C720660 for ; Wed, 27 May 2015 11:20:05 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 42EEF206AB for ; Wed, 27 May 2015 11:20:04 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id C62236E923; Wed, 27 May 2015 04:19:56 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by gabe.freedesktop.org (Postfix) with ESMTP id B66CC6E834; Wed, 27 May 2015 03:04:28 -0700 (PDT) Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (Postfix) with ESMTPS id 75B19B5E9E; Wed, 27 May 2015 10:04:28 +0000 (UTC) Received: from rhwork.redhat.com (vpn1-7-206.ams2.redhat.com [10.36.7.206]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t4RA4FqO007874; Wed, 27 May 2015 06:04:26 -0400 From: Frediano Ziglio To: fziglio@redhat.com, spice-devel@lists.freedesktop.org, airlied@linux.ie, dri-devel@lists.freedesktop.org, airlied@redhat.com Subject: [PATCH 04/11] Avoid double free on error Date: Wed, 27 May 2015 11:03:59 +0100 Message-Id: <1432721046-4418-5-git-send-email-fziglio@redhat.com> In-Reply-To: <1432721046-4418-1-git-send-email-fziglio@redhat.com> References: <1432721046-4418-1-git-send-email-fziglio@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 X-Mailman-Approved-At: Wed, 27 May 2015 04:19:54 -0700 Cc: linux-kernel@vger.kernel.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Is we are not able to get source bo object from handle we free destination bo object and call cleanup code however destination object was already inserted in reloc_info array (num_relocs was already incremented) so on cleanup we free destination again. Signed-off-by: Frediano Ziglio Reviewed-by: Dave Airlie --- qxl/qxl_ioctl.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/qxl/qxl_ioctl.c b/qxl/qxl_ioctl.c index 230ab84..85b3808 100644 --- a/qxl/qxl_ioctl.c +++ b/qxl/qxl_ioctl.c @@ -240,8 +240,6 @@ static int qxl_process_single_command(struct qxl_device *qdev, qxlhw_handle_to_bo(qdev, file_priv, reloc.src_handle, release); if (!reloc_info[i].src_bo) { - if (reloc_info[i].dst_bo != cmd_bo) - drm_gem_object_unreference_unlocked(&reloc_info[i].dst_bo->gem_base); ret = -EINVAL; goto out_free_bos; }