From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Date: Mon, 01 Oct 2018 16:45:05 +0000 Subject: [PATCH] drm/omap: Use after free in omap_connector_destroy() Message-Id: <20181001164505.GB29248@mwanda> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Tomi Valkeinen , Laurent Pinchart Cc: David Airlie , kernel-janitors@vger.kernel.org, dri-devel@lists.freedesktop.org We can free "omap_connector" until the end of the function. Fixes: 949ea2ef3fed ("drm/omap: Don't call HPD registration operations recursively") Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/omapdrm/omap_connector.c b/drivers/gpu/drm/omapdrm/omap_connector.c index 98f5ca29444a..b81302c4bf9e 100644 --- a/drivers/gpu/drm/omapdrm/omap_connector.c +++ b/drivers/gpu/drm/omapdrm/omap_connector.c @@ -164,10 +164,11 @@ static void omap_connector_destroy(struct drm_connector *connector) drm_connector_unregister(connector); drm_connector_cleanup(connector); - kfree(omap_connector); omapdss_device_put(omap_connector->output); omapdss_device_put(omap_connector->display); + + kfree(omap_connector); } #define MAX_EDID 512 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: [PATCH] drm/omap: Use after free in omap_connector_destroy() Date: Mon, 1 Oct 2018 19:45:05 +0300 Message-ID: <20181001164505.GB29248@mwanda> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from userp2130.oracle.com (userp2130.oracle.com [156.151.31.86]) by gabe.freedesktop.org (Postfix) with ESMTPS id 258066E223 for ; Mon, 1 Oct 2018 16:45:23 +0000 (UTC) Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Tomi Valkeinen , Laurent Pinchart Cc: David Airlie , kernel-janitors@vger.kernel.org, dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org V2UgY2FuIGZyZWUgIm9tYXBfY29ubmVjdG9yIiB1bnRpbCB0aGUgZW5kIG9mIHRoZSBmdW5jdGlv bi4KCkZpeGVzOiA5NDllYTJlZjNmZWQgKCJkcm0vb21hcDogRG9uJ3QgY2FsbCBIUEQgcmVnaXN0 cmF0aW9uIG9wZXJhdGlvbnMgcmVjdXJzaXZlbHkiKQpTaWduZWQtb2ZmLWJ5OiBEYW4gQ2FycGVu dGVyIDxkYW4uY2FycGVudGVyQG9yYWNsZS5jb20+CgpkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUv ZHJtL29tYXBkcm0vb21hcF9jb25uZWN0b3IuYyBiL2RyaXZlcnMvZ3B1L2RybS9vbWFwZHJtL29t YXBfY29ubmVjdG9yLmMKaW5kZXggOThmNWNhMjk0NDRhLi5iODEzMDJjNGJmOWUgMTAwNjQ0Ci0t LSBhL2RyaXZlcnMvZ3B1L2RybS9vbWFwZHJtL29tYXBfY29ubmVjdG9yLmMKKysrIGIvZHJpdmVy cy9ncHUvZHJtL29tYXBkcm0vb21hcF9jb25uZWN0b3IuYwpAQCAtMTY0LDEwICsxNjQsMTEgQEAg c3RhdGljIHZvaWQgb21hcF9jb25uZWN0b3JfZGVzdHJveShzdHJ1Y3QgZHJtX2Nvbm5lY3RvciAq Y29ubmVjdG9yKQogCiAJZHJtX2Nvbm5lY3Rvcl91bnJlZ2lzdGVyKGNvbm5lY3Rvcik7CiAJZHJt X2Nvbm5lY3Rvcl9jbGVhbnVwKGNvbm5lY3Rvcik7Ci0Ja2ZyZWUob21hcF9jb25uZWN0b3IpOwog CiAJb21hcGRzc19kZXZpY2VfcHV0KG9tYXBfY29ubmVjdG9yLT5vdXRwdXQpOwogCW9tYXBkc3Nf ZGV2aWNlX3B1dChvbWFwX2Nvbm5lY3Rvci0+ZGlzcGxheSk7CisKKwlrZnJlZShvbWFwX2Nvbm5l Y3Rvcik7CiB9CiAKICNkZWZpbmUgTUFYX0VESUQgIDUxMgpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXwpkcmktZGV2ZWwgbWFpbGluZyBsaXN0CmRyaS1kZXZl bEBsaXN0cy5mcmVlZGVza3RvcC5vcmcKaHR0cHM6Ly9saXN0cy5mcmVlZGVza3RvcC5vcmcvbWFp bG1hbi9saXN0aW5mby9kcmktZGV2ZWwK