[PATCH -next] drm/tegra: sor: Fix invalid kfree of devm_kzalloc allocated data

[PATCH -next] drm/tegra: sor: Fix invalid kfree of devm_kzalloc allocated data

[weiyj_lk-9Onoh4P/yGk]

From: Wei Yongjun <yongjun_wei-zrsr2BFq86L20UzCJQGyNP8+0UxHXcjY@public.gmane.org>

data allocated with devm_kzalloc should not be freed using kfree,
because doing so causes a dangling pointer, and a subsequent
double free, use devm_kfree instead.

Signed-off-by: Wei Yongjun <yongjun_wei-zrsr2BFq86L20UzCJQGyNP8+0UxHXcjY@public.gmane.org>
---
 drivers/gpu/drm/tegra/sor.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
index 8425eda..af98587 100644
--- a/drivers/gpu/drm/tegra/sor.c
+++ b/drivers/gpu/drm/tegra/sor.c
@@ -363,7 +363,7 @@ static struct clk *tegra_clk_sor_brick_register(struct tegra_sor *sor,
 
 	clk = devm_clk_register(sor->dev, &brick->hw);
 	if (IS_ERR(clk))
-		kfree(brick);
+		devm_kfree(sor->dev, brick);
 
 	return clk;
 }

Re: [PATCH -next] drm/tegra: sor: Fix invalid kfree of devm_kzalloc allocated data

[Alexandre Courbot]

On Mon, Jul 4, 2016 at 4:19 PM,  <weiyj_lk@163.com> wrote:
> From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
>
> data allocated with devm_kzalloc should not be freed using kfree,
> because doing so causes a dangling pointer, and a subsequent
> double free, use devm_kfree instead.
>
> Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
> ---
>  drivers/gpu/drm/tegra/sor.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
> index 8425eda..af98587 100644
> --- a/drivers/gpu/drm/tegra/sor.c
> +++ b/drivers/gpu/drm/tegra/sor.c
> @@ -363,7 +363,7 @@ static struct clk *tegra_clk_sor_brick_register(struct tegra_sor *sor,
>
>         clk = devm_clk_register(sor->dev, &brick->hw);
>         if (IS_ERR(clk))
> -               kfree(brick);
> +               devm_kfree(sor->dev, brick);
>
>         return clk;
>  }

Dan sent another fix for this:

https://lkml.org/lkml/2016/7/4/83

I tend to prefer his solution since it has a negative line count and
also doesn't do the (unneeded) explicit devm_kfree().

Thanks though!
Alex.
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel