* [PATCH] drm: Don't free a struct never allocated by drm_gem_fb_init()
@ 2020-04-15 17:20 Andrzej Pietrasiewicz
0 siblings, 0 replies; 2+ messages in thread
From: Andrzej Pietrasiewicz @ 2020-04-15 17:20 UTC (permalink / raw)
To: dri-devel
drm_gem_fb_init() is passed the fb and never allocates it, so it should be
not the one freeing it. As it is now the second call to kfree() is possible
with the same fb. Coverity reported the following:
*** CID 1492613: Memory - corruptions (USE_AFTER_FREE)
/drivers/gpu/drm/drm_gem_framebuffer_helper.c: 230 in drm_gem_fb_create_with_funcs()
224 fb = kzalloc(sizeof(*fb), GFP_KERNEL);
225 if (!fb)
226 return ERR_PTR(-ENOMEM);
227
228 ret = drm_gem_fb_init_with_funcs(dev, fb, file, mode_cmd, funcs);
229 if (ret) {
vvv CID 1492613: Memory - corruptions (USE_AFTER_FREE)
vvv Calling "kfree" frees pointer "fb" which has already been freed. [Note: The source code implementation of the function has been overridden by a user model.]
230 kfree(fb);
231 return ERR_PTR(ret);
232 }
233
234 return fb;
235 }
drm_gem_fb_init_with_funcs() calls drm_gem_fb_init()
drm_gem_fb_init() calls kfree(fb)
Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1492613 ("Memory - corruptions")
Fixes: f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer")
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
---
drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem_framebuffer_helper.c b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
index cac15294aef6..ccc2c71fa491 100644
--- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c
+++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
@@ -76,10 +76,8 @@ drm_gem_fb_init(struct drm_device *dev,
fb->obj[i] = obj[i];
ret = drm_framebuffer_init(dev, fb, funcs);
- if (ret) {
+ if (ret)
drm_err(dev, "Failed to init framebuffer: %d\n", ret);
- kfree(fb);
- }
return ret;
}
--
2.17.1
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] drm: Don't free a struct never allocated by drm_gem_fb_init()
[not found] ` <CAKMK7uG3zQBVh_b+mwz4o8x29cWHnsPaR9kvP9OtCFisSUgeYg@mail.gmail.com>
@ 2020-04-16 11:35 ` Andrzej Pietrasiewicz
0 siblings, 0 replies; 2+ messages in thread
From: Andrzej Pietrasiewicz @ 2020-04-16 11:35 UTC (permalink / raw)
To: Daniel Vetter; +Cc: Maling list - DRI developers
W dniu 15.04.2020 o 20:33, Daniel Vetter pisze:
> On Wed, Apr 15, 2020 at 7:19 PM Andrzej Pietrasiewicz
> <andrzej.p@collabora.com> wrote:
>>
>> drm_gem_fb_init() is passed the fb and never allocates it, so it should be
>> not the one freeing it. As it is now the second call to kfree() is possible
>> with the same fb. Coverity reported the following:
>>
>> *** CID 1492613: Memory - corruptions (USE_AFTER_FREE)
>> /drivers/gpu/drm/drm_gem_framebuffer_helper.c: 230 in drm_gem_fb_create_with_funcs()
>> 224 fb = kzalloc(sizeof(*fb), GFP_KERNEL);
>> 225 if (!fb)
>> 226 return ERR_PTR(-ENOMEM);
>> 227
>> 228 ret = drm_gem_fb_init_with_funcs(dev, fb, file, mode_cmd, funcs);
>> 229 if (ret) {
>> vvv CID 1492613: Memory - corruptions (USE_AFTER_FREE)
>> vvv Calling "kfree" frees pointer "fb" which has already been freed. [Note: The source code implementation of the function has been overridden by a user model.]
>> 230 kfree(fb);
>> 231 return ERR_PTR(ret);
>> 232 }
>> 233
>> 234 return fb;
>> 235 }
>>
>> drm_gem_fb_init_with_funcs() calls drm_gem_fb_init()
>> drm_gem_fb_init() calls kfree(fb)
>>
>> Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
>> Addresses-Coverity-ID: 1492613 ("Memory - corruptions")
>> Fixes: f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer")
>> Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
>
> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
>
>> ---
>> drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +---
>> 1 file changed, 1 insertion(+), 3 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/drm_gem_framebuffer_helper.c b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
>> index cac15294aef6..ccc2c71fa491 100644
>> --- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c
>> +++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
>> @@ -76,10 +76,8 @@ drm_gem_fb_init(struct drm_device *dev,
>> fb->obj[i] = obj[i];
>>
>> ret = drm_framebuffer_init(dev, fb, funcs);
>> - if (ret) {
>> + if (ret)
>> drm_err(dev, "Failed to init framebuffer: %d\n", ret);
>> - kfree(fb);
>> - }
>>
>> return ret;
>> }
>> --
>> 2.17.1
>>
>
>
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-04-16 11:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-15 17:20 [PATCH] drm: Don't free a struct never allocated by drm_gem_fb_init() Andrzej Pietrasiewicz
[not found] <202004150853.FD574CDD@keescook>
[not found] ` <20200415171901.23914-1-andrzej.p@collabora.com>
[not found] ` <CAKMK7uG3zQBVh_b+mwz4o8x29cWHnsPaR9kvP9OtCFisSUgeYg@mail.gmail.com>
2020-04-16 11:35 ` Andrzej Pietrasiewicz
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).