Re: [patch] video: of: display_timing: double free on error

Re: [patch] video: of: display_timing: double free on error

[Tomi Valkeinen]

[-- Attachment #1: Type: text/plain, Size: 1030 bytes --]

On 11/07/14 12:21, Dan Carpenter wrote:
> The display_timings_release() function frees "disp" and we free it
> again on the next line.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/video/of_display_timing.c b/drivers/video/of_display_timing.c
> index 987edf1..5c098d5 100644
> --- a/drivers/video/of_display_timing.c
> +++ b/drivers/video/of_display_timing.c
> @@ -236,6 +236,7 @@ timingfail:
>  	if (native_mode)
>  		of_node_put(native_mode);
>  	display_timings_release(disp);
> +	disp = NULL;
>  entryfail:
>  	kfree(disp);
>  dispfail:
> 

Thanks, queued for 3.17 fbdev fixes.

The code looks a bit messy to me, though. I'm not fond of "kalloc here,
kfree there" style.

Maybe this would be slightly cleaner, if display_timings_release() would
accept NULL parameter. Then the code above could just use
display_timings_release(), and there'd be no need for kfree.

In any case, that's stuff for an other patch. This one is fine fix for 3.17.

 Tomi



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

[patch] video: of: display_timing: double free on error

[Dan Carpenter]

The display_timings_release() function frees "disp" and we free it
again on the next line.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/video/of_display_timing.c b/drivers/video/of_display_timing.c
index 987edf1..5c098d5 100644
--- a/drivers/video/of_display_timing.c
+++ b/drivers/video/of_display_timing.c
@@ -236,6 +236,7 @@ timingfail:
 	if (native_mode)
 		of_node_put(native_mode);
 	display_timings_release(disp);
+	disp = NULL;
 entryfail:
 	kfree(disp);
 dispfail: