Skip to content

Commit

Permalink
drm/msm: Fix potential invalid ptr free
Browse files Browse the repository at this point in the history
The error path cleanup expects that chain and syncobj are either NULL or
valid pointers.  But post_deps was not allocated with __GFP_ZERO.

Fixes: ab723b7 ("drm/msm: Add syncobj support.")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Patchwork: https://patchwork.freedesktop.org/patch/523051/
Link: https://lore.kernel.org/r/20230215235048.1166484-1-robdclark@gmail.com
  • Loading branch information
Rob Clark committed Feb 22, 2023
1 parent 92dd057 commit 8a86f21
Showing 1 changed file with 2 additions and 3 deletions.
5 changes: 2 additions & 3 deletions drivers/gpu/drm/msm/msm_gem_submit.c
Original file line number Diff line number Diff line change
Expand Up @@ -637,8 +637,8 @@ static struct msm_submit_post_dep *msm_parse_post_deps(struct drm_device *dev,
int ret = 0;
uint32_t i, j;

post_deps = kmalloc_array(nr_syncobjs, sizeof(*post_deps),
GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY);
post_deps = kcalloc(nr_syncobjs, sizeof(*post_deps),
GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY);
if (!post_deps)
return ERR_PTR(-ENOMEM);

Expand All @@ -653,7 +653,6 @@ static struct msm_submit_post_dep *msm_parse_post_deps(struct drm_device *dev,
}

post_deps[i].point = syncobj_desc.point;
post_deps[i].chain = NULL;

if (syncobj_desc.flags) {
ret = -EINVAL;
Expand Down

0 comments on commit 8a86f21

Please sign in to comment.