lkml.org 
[lkml]   [2020]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.5 003/542] drm/dp_mst: fix multiple frees of tx->bytes
    Date
    From: Colin Ian King <colin.king@canonical.com>

    [ Upstream commit 2c8bc91488fc57438c43b3bb19deb7fdbc1e5119 ]

    Currently tx->bytes is being freed r->num_transactions number of
    times because tx is not being set correctly. Fix this by setting
    tx to &r->transactions[i] so that the correct objects are being
    freed on each loop iteration.

    Addresses-Coverity: ("Double free")
    Fixes: 2f015ec6eab6 ("drm/dp_mst: Add sideband down request tracing + selftests")
    Signed-off-by: Colin Ian King <colin.king@canonical.com>
    Signed-off-by: Lyude Paul <lyude@redhat.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20191120173509.347490-1-colin.king@canonical.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/gpu/drm/drm_dp_mst_topology.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
    index 141ba31cf5486..cfee59e9c85e5 100644
    --- a/drivers/gpu/drm/drm_dp_mst_topology.c
    +++ b/drivers/gpu/drm/drm_dp_mst_topology.c
    @@ -517,8 +517,10 @@ drm_dp_decode_sideband_req(const struct drm_dp_sideband_msg_tx *raw,
    }

    if (failed) {
    - for (i = 0; i < r->num_transactions; i++)
    + for (i = 0; i < r->num_transactions; i++) {
    + tx = &r->transactions[i];
    kfree(tx->bytes);
    + }
    return -ENOMEM;
    }

    --
    2.20.1
    \
     
     \ /
      Last update: 2020-02-14 19:26    [W:2.149 / U:1.548 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site