From mboxrd@z Thu Jan 1 00:00:00 1970 From: Laurent Pinchart Date: Mon, 01 Oct 2018 23:50:45 +0000 Subject: Re: [PATCH] drm/omap: Use after free in omap_connector_destroy() Message-Id: <8319740.4GPcRUpbZa@avalon> List-Id: References: <20181001164505.GB29248@mwanda> In-Reply-To: <20181001164505.GB29248@mwanda> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Dan Carpenter Cc: David Airlie , Tomi Valkeinen , kernel-janitors@vger.kernel.org, dri-devel@lists.freedesktop.org Hi Dan, Thank you for the patch. On Monday, 1 October 2018 19:45:05 EEST Dan Carpenter wrote: > We can free "omap_connector" until the end of the function. > > Fixes: 949ea2ef3fed ("drm/omap: Don't call HPD registration operations > recursively") Signed-off-by: Dan Carpenter This has already been fixed by https://www.spinics.net/lists/dri-devel/ msg190817.html. > diff --git a/drivers/gpu/drm/omapdrm/omap_connector.c > b/drivers/gpu/drm/omapdrm/omap_connector.c index 98f5ca29444a..b81302c4bf9e > 100644 > --- a/drivers/gpu/drm/omapdrm/omap_connector.c > +++ b/drivers/gpu/drm/omapdrm/omap_connector.c > @@ -164,10 +164,11 @@ static void omap_connector_destroy(struct > drm_connector *connector) > > drm_connector_unregister(connector); > drm_connector_cleanup(connector); > - kfree(omap_connector); > > omapdss_device_put(omap_connector->output); > omapdss_device_put(omap_connector->display); > + > + kfree(omap_connector); > } > > #define MAX_EDID 512 -- Regards, Laurent Pinchart From mboxrd@z Thu Jan 1 00:00:00 1970 From: Laurent Pinchart Subject: Re: [PATCH] drm/omap: Use after free in omap_connector_destroy() Date: Tue, 02 Oct 2018 02:50:45 +0300 Message-ID: <8319740.4GPcRUpbZa@avalon> References: <20181001164505.GB29248@mwanda> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from perceval.ideasonboard.com (perceval.ideasonboard.com [213.167.242.64]) by gabe.freedesktop.org (Postfix) with ESMTPS id 20A056E01F for ; Mon, 1 Oct 2018 23:50:31 +0000 (UTC) In-Reply-To: <20181001164505.GB29248@mwanda> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Dan Carpenter Cc: David Airlie , Tomi Valkeinen , kernel-janitors@vger.kernel.org, dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org SGkgRGFuLAoKVGhhbmsgeW91IGZvciB0aGUgcGF0Y2guCgpPbiBNb25kYXksIDEgT2N0b2JlciAy MDE4IDE5OjQ1OjA1IEVFU1QgRGFuIENhcnBlbnRlciB3cm90ZToKPiBXZSBjYW4gZnJlZSAib21h cF9jb25uZWN0b3IiIHVudGlsIHRoZSBlbmQgb2YgdGhlIGZ1bmN0aW9uLgo+IAo+IEZpeGVzOiA5 NDllYTJlZjNmZWQgKCJkcm0vb21hcDogRG9uJ3QgY2FsbCBIUEQgcmVnaXN0cmF0aW9uIG9wZXJh dGlvbnMKPiByZWN1cnNpdmVseSIpIFNpZ25lZC1vZmYtYnk6IERhbiBDYXJwZW50ZXIgPGRhbi5j YXJwZW50ZXJAb3JhY2xlLmNvbT4KClRoaXMgaGFzIGFscmVhZHkgYmVlbiBmaXhlZCBieSBodHRw czovL3d3dy5zcGluaWNzLm5ldC9saXN0cy9kcmktZGV2ZWwvCm1zZzE5MDgxNy5odG1sLgoKPiBk aWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUvZHJtL29tYXBkcm0vb21hcF9jb25uZWN0b3IuYwo+IGIv ZHJpdmVycy9ncHUvZHJtL29tYXBkcm0vb21hcF9jb25uZWN0b3IuYyBpbmRleCA5OGY1Y2EyOTQ0 NGEuLmI4MTMwMmM0YmY5ZQo+IDEwMDY0NAo+IC0tLSBhL2RyaXZlcnMvZ3B1L2RybS9vbWFwZHJt L29tYXBfY29ubmVjdG9yLmMKPiArKysgYi9kcml2ZXJzL2dwdS9kcm0vb21hcGRybS9vbWFwX2Nv bm5lY3Rvci5jCj4gQEAgLTE2NCwxMCArMTY0LDExIEBAIHN0YXRpYyB2b2lkIG9tYXBfY29ubmVj dG9yX2Rlc3Ryb3koc3RydWN0Cj4gZHJtX2Nvbm5lY3RvciAqY29ubmVjdG9yKQo+IAo+ICAJZHJt X2Nvbm5lY3Rvcl91bnJlZ2lzdGVyKGNvbm5lY3Rvcik7Cj4gIAlkcm1fY29ubmVjdG9yX2NsZWFu dXAoY29ubmVjdG9yKTsKPiAtCWtmcmVlKG9tYXBfY29ubmVjdG9yKTsKPiAKPiAgCW9tYXBkc3Nf ZGV2aWNlX3B1dChvbWFwX2Nvbm5lY3Rvci0+b3V0cHV0KTsKPiAgCW9tYXBkc3NfZGV2aWNlX3B1 dChvbWFwX2Nvbm5lY3Rvci0+ZGlzcGxheSk7Cj4gKwo+ICsJa2ZyZWUob21hcF9jb25uZWN0b3Ip Owo+ICB9Cj4gCj4gICNkZWZpbmUgTUFYX0VESUQgIDUxMgoKCi0tIApSZWdhcmRzLAoKTGF1cmVu dCBQaW5jaGFydAoKCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXwpkcmktZGV2ZWwgbWFpbGluZyBsaXN0CmRyaS1kZXZlbEBsaXN0cy5mcmVlZGVza3RvcC5v cmcKaHR0cHM6Ly9saXN0cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0aW5mby9kcmktZGV2 ZWwK