drm/msm/dp: Fix a potential double free in an error handling path

[PATCH] drm/msm/dp: Fix a potential double free in an error handling path

Posted by Christophe JAILLET 4 years, 6 months ago

'dp_bridge' is devm_alloc'ed, so there is no need to free it explicitly or
there will be a double free().

Fixes: 8a3b4c17f863 ("drm/msm/dp: employ bridge mechanism for display enable and disable")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
---
 drivers/gpu/drm/msm/dp/dp_drm.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_drm.c b/drivers/gpu/drm/msm/dp/dp_drm.c
index 188e77c59885..d4d360d19eba 100644
--- a/drivers/gpu/drm/msm/dp/dp_drm.c
+++ b/drivers/gpu/drm/msm/dp/dp_drm.c
@@ -243,7 +243,6 @@ struct drm_bridge *msm_dp_bridge_init(struct msm_dp *dp_display, struct drm_devi
 	rc = drm_bridge_attach(encoder, bridge, NULL, DRM_BRIDGE_ATTACH_NO_CONNECTOR);
 	if (rc) {
 		DRM_ERROR("failed to attach bridge, rc=%d\n", rc);
-		kfree(dp_bridge);
 		return ERR_PTR(rc);
 	}
 
-- 
2.32.0

Re: [PATCH] drm/msm/dp: Fix a potential double free in an error handling path

Posted by Kuogee Hsieh 4 years, 6 months ago

On 12/26/2021 7:14 AM, Christophe JAILLET wrote:
> 'dp_bridge' is devm_alloc'ed, so there is no need to free it explicitly or
> there will be a double free().
>
> Fixes: 8a3b4c17f863 ("drm/msm/dp: employ bridge mechanism for display enable and disable")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
> ---
>   drivers/gpu/drm/msm/dp/dp_drm.c | 1 -
>   1 file changed, 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/msm/dp/dp_drm.c b/drivers/gpu/drm/msm/dp/dp_drm.c
> index 188e77c59885..d4d360d19eba 100644
> --- a/drivers/gpu/drm/msm/dp/dp_drm.c
> +++ b/drivers/gpu/drm/msm/dp/dp_drm.c
> @@ -243,7 +243,6 @@ struct drm_bridge *msm_dp_bridge_init(struct msm_dp *dp_display, struct drm_devi
>   	rc = drm_bridge_attach(encoder, bridge, NULL, DRM_BRIDGE_ATTACH_NO_CONNECTOR);
>   	if (rc) {
>   		DRM_ERROR("failed to attach bridge, rc=%d\n", rc);
> -		kfree(dp_bridge);
>   		return ERR_PTR(rc);
>   	}
>

Re: [PATCH] drm/msm/dp: Fix a potential double free in an error handling path

Posted by Stephen Boyd 4 years, 5 months ago

Quoting Christophe JAILLET (2021-12-26 07:14:05)
> 'dp_bridge' is devm_alloc'ed, so there is no need to free it explicitly or
> there will be a double free().
>
> Fixes: 8a3b4c17f863 ("drm/msm/dp: employ bridge mechanism for display enable and disable")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> ---

Reviewed-by: Stephen Boyd <swboyd@chromium.org>

Re: [PATCH] drm/msm/dp: Fix a potential double free in an error handling path

Posted by Christophe JAILLET 4 years, 5 months ago

Le 05/01/2022 à 21:09, Stephen Boyd a écrit :
> Quoting Christophe JAILLET (2021-12-26 07:14:05)
>> 'dp_bridge' is devm_alloc'ed, so there is no need to free it explicitly or
>> there will be a double free().
>>
>> Fixes: 8a3b4c17f863 ("drm/msm/dp: employ bridge mechanism for display enable and disable")
>> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
>> ---
> 
> Reviewed-by: Stephen Boyd <swboyd@chromium.org>
> 

and

 >
 > Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
 >


Hi,

Just for your information, it has also been reported by Dan Carpenter 1 
or 2 weeks before me and is part of -next in commit 48d0cf4a7cf2.

CJ