| Message ID | 20180712091840.37272-1-noralf@tronnes.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Thu, Jul 12, 2018 at 11:18:40AM +0200, Noralf Trønnes wrote: > This fixes a static checker warning: > > drivers/gpu/drm/drm_client.c:289 drm_client_buffer_create() > error: double free of 'buffer' > > drm_client_buffer_delete() frees the buffer so remove the extra free. > > Fixes: c76f0f7cb546 ("drm: Begin an API for in-kernel clients") > Reported-by: Dan Carpenter <dan.carpenter@oracle.com> > Cc: Daniel Vetter <daniel.vetter@ffwll.ch> > Signed-off-by: Noralf Trønnes <noralf@tronnes.org> You could also put an if (buffer->handle) into drm_client_buffer_delete and simplify the code even more. handle == 0 is the canonical invalid handle - all our idr start at 1. But this works too. On either approach: Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> > --- > drivers/gpu/drm/drm_client.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c > index 9b142f58d489..83b294ae3e4e 100644 > --- a/drivers/gpu/drm/drm_client.c > +++ b/drivers/gpu/drm/drm_client.c > @@ -242,8 +242,10 @@ drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height, u > dumb_args.height = height; > dumb_args.bpp = drm_format_plane_cpp(format, 0) * 8; > ret = drm_mode_create_dumb(dev, &dumb_args, client->file); > - if (ret) > - goto err_free; > + if (ret) { > + kfree(buffer); > + return ERR_PTR(ret); > + } > > buffer->handle = dumb_args.handle; > buffer->pitch = dumb_args.pitch; > @@ -276,8 +278,6 @@ drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height, u > > err_delete: > drm_client_buffer_delete(buffer); > -err_free: > - kfree(buffer); > > return ERR_PTR(ret); > } > -- > 2.15.1 >
diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c index 9b142f58d489..83b294ae3e4e 100644 --- a/drivers/gpu/drm/drm_client.c +++ b/drivers/gpu/drm/drm_client.c @@ -242,8 +242,10 @@ drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height, u dumb_args.height = height; dumb_args.bpp = drm_format_plane_cpp(format, 0) * 8; ret = drm_mode_create_dumb(dev, &dumb_args, client->file); - if (ret) - goto err_free; + if (ret) { + kfree(buffer); + return ERR_PTR(ret); + } buffer->handle = dumb_args.handle; buffer->pitch = dumb_args.pitch; @@ -276,8 +278,6 @@ drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height, u err_delete: drm_client_buffer_delete(buffer); -err_free: - kfree(buffer); return ERR_PTR(ret); }
This fixes a static checker warning: drivers/gpu/drm/drm_client.c:289 drm_client_buffer_create() error: double free of 'buffer' drm_client_buffer_delete() frees the buffer so remove the extra free. Fixes: c76f0f7cb546 ("drm: Begin an API for in-kernel clients") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Noralf Trønnes <noralf@tronnes.org> --- drivers/gpu/drm/drm_client.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)