From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stephane Viau Subject: [PATCH] drm/msm: fix unbalanced DRM framebuffer init/destroy Date: Tue, 5 May 2015 09:47:57 -0400 Message-ID: <1430833677-16010-1-git-send-email-sviau@codeaurora.org> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel@lists.freedesktop.org Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org List-Id: linux-arm-msm@vger.kernel.org V2hlbiBtc21fZnJhbWVidWZmZXJfaW5pdCgpIGZhaWxzIGJlZm9yZSBjYWxsaW5nIGRybV9mcmFt ZWJ1ZmZlcl9pbml0KCksCmRybV9mcmFtZWJ1ZmZlcl9jbGVhbnVwKCkgW2NhbGxlZCBpbiBtc21f ZnJhbWVidWZmZXJfZGVzdHJveSgpXQppcyBzdGlsbCBiZWluZyBjYWxsZWQgZXZlbiB0aG91Z2gg ZHJtX2ZyYW1lYnVmZmVyX2luaXQoKSB3YXMgbm90CmNhbGxlZCBmb3IgdGhhdCBidWZmZXIuIFRo dXMgYSBOVUxMIHBvaW50ZXIgZGVyZWZlbmNpbmc6CgpbICAyNDcuNTI5NjkxXSBVbmFibGUgdG8g aGFuZGxlIGtlcm5lbCBOVUxMIHBvaW50ZXIgZGVyZWZlcmVuY2UgYXQgdmlydHVhbCBhZGRyZXNz IDAwMDAwMjdjCi4uLgpbICAyNDcuNTYzOTk2XSBQQyBpcyBhdCBfX211dGV4X2xvY2tfc2xvd3Bh dGgrMHg5NC8weDNhOAouLi4KWyAgMjQ3LjgyMzAyNV0gWzxjMDdjM2M3OD5dIChfX211dGV4X2xv Y2tfc2xvd3BhdGgpIGZyb20gWzxjMDdjM2ZhYz5dIChtdXRleF9sb2NrKzB4MjAvMHgzYykKWyAg MjQ3LjgzMTE4Nl0gWzxjMDdjM2ZhYz5dIChtdXRleF9sb2NrKSBmcm9tIFs8YzAzNDdjZjA+XSAo ZHJtX2ZyYW1lYnVmZmVyX2NsZWFudXArMHgxOC8weDM4KQpbICAyNDcuODM5NTIwXSBbPGMwMzQ3 Y2YwPl0gKGRybV9mcmFtZWJ1ZmZlcl9jbGVhbnVwKSBmcm9tIFs8YzAzNmQxMzg+XSAobXNtX2Zy YW1lYnVmZmVyX2Rlc3Ryb3krMHg0OC8weDEwMCkKWyAgMjQ3Ljg0OTA2Nl0gWzxjMDM2ZDEzOD5d IChtc21fZnJhbWVidWZmZXJfZGVzdHJveSkgZnJvbSBbPGMwMzZkNTgwPl0gKG1zbV9mcmFtZWJ1 ZmZlcl9pbml0KzB4MWU4LzB4MjI4KQpbICAyNDcuODU4NDM5XSBbPGMwMzZkNTgwPl0gKG1zbV9m cmFtZWJ1ZmZlcl9pbml0KSBmcm9tIFs8YzAzNmQ2MzA+XSAobXNtX2ZyYW1lYnVmZmVyX2NyZWF0 ZSsweDcwLzB4MTM0KQpbICAyNDcuODY3NjQyXSBbPGMwMzZkNjMwPl0gKG1zbV9mcmFtZWJ1ZmZl cl9jcmVhdGUpIGZyb20gWzxjMDM0OTNlYz5dIChpbnRlcm5hbF9mcmFtZWJ1ZmZlcl9jcmVhdGUr MHg2N2MvMHg3YjQpClsgIDI0Ny44Nzc1MzddIFs8YzAzNDkzZWM+XSAoaW50ZXJuYWxfZnJhbWVi dWZmZXJfY3JlYXRlKSBmcm9tIFs8YzAzNGNlMzQ+XSAoZHJtX21vZGVfYWRkZmIyKzB4MjAvMHg5 OCkKWyAgMjQ3Ljg4NjY1MF0gWzxjMDM0Y2UzND5dIChkcm1fbW9kZV9hZGRmYjIpIGZyb20gWzxj MDM0MDcxYz5dIChkcm1faW9jdGwrMHgyNDAvMHg0MjApClsgIDI0Ny44OTQzNzhdIFs8YzAzNDA3 MWM+XSAoZHJtX2lvY3RsKSBmcm9tIFs8YzAxMWRmN2M+XSAoZG9fdmZzX2lvY3RsKzB4NGU0LzB4 NWE0KQouLi4KClNpZ25lZC1vZmYtYnk6IFN0ZXBoYW5lIFZpYXUgPHN2aWF1QGNvZGVhdXJvcmEu b3JnPgotLS0KIGRyaXZlcnMvZ3B1L2RybS9tc20vbXNtX2ZiLmMgfCAzICstLQogMSBmaWxlIGNo YW5nZWQsIDEgaW5zZXJ0aW9uKCspLCAyIGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL2RyaXZl cnMvZ3B1L2RybS9tc20vbXNtX2ZiLmMgYi9kcml2ZXJzL2dwdS9kcm0vbXNtL21zbV9mYi5jCmlu ZGV4IDZiNTczZTYuLmMwZjA5ZDMgMTAwNjQ0Ci0tLSBhL2RyaXZlcnMvZ3B1L2RybS9tc20vbXNt X2ZiLmMKKysrIGIvZHJpdmVycy9ncHUvZHJtL21zbS9tc21fZmIuYwpAQCAtMjM5LDggKzIzOSw3 IEBAIHN0cnVjdCBkcm1fZnJhbWVidWZmZXIgKm1zbV9mcmFtZWJ1ZmZlcl9pbml0KHN0cnVjdCBk cm1fZGV2aWNlICpkZXYsCiAJcmV0dXJuIGZiOwogCiBmYWlsOgotCWlmIChmYikKLQkJbXNtX2Zy YW1lYnVmZmVyX2Rlc3Ryb3koZmIpOworCWtmcmVlKG1zbV9mYik7CiAKIAlyZXR1cm4gRVJSX1BU UihyZXQpOwogfQotLSAKUXVhbGNvbW0gSW5ub3ZhdGlvbiBDZW50ZXIsIEluYy4KClRoZSBRdWFs Y29tbSBJbm5vdmF0aW9uIENlbnRlciwgSW5jLiBpcyBhIG1lbWJlciBvZiB0aGUgQ29kZSBBdXJv cmEgRm9ydW0sIGEgTGludXggRm91bmRhdGlvbiBDb2xsYWJvcmF0aXZlIFByb2plY3QKCl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCmRyaS1kZXZlbCBtYWls aW5nIGxpc3QKZHJpLWRldmVsQGxpc3RzLmZyZWVkZXNrdG9wLm9yZwpodHRwOi8vbGlzdHMuZnJl ZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRldmVsCg== From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2992589AbbEENsk (ORCPT ); Tue, 5 May 2015 09:48:40 -0400 Received: from smtp.codeaurora.org ([198.145.29.96]:49934 "EHLO smtp.codeaurora.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2992570AbbEENs1 (ORCPT ); Tue, 5 May 2015 09:48:27 -0400 From: Stephane Viau To: dri-devel@lists.freedesktop.org Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, robdclark@gmail.com, Stephane Viau Subject: [PATCH] drm/msm: fix unbalanced DRM framebuffer init/destroy Date: Tue, 5 May 2015 09:47:57 -0400 Message-Id: <1430833677-16010-1-git-send-email-sviau@codeaurora.org> X-Mailer: git-send-email 1.8.2.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When msm_framebuffer_init() fails before calling drm_framebuffer_init(), drm_framebuffer_cleanup() [called in msm_framebuffer_destroy()] is still being called even though drm_framebuffer_init() was not called for that buffer. Thus a NULL pointer derefencing: [ 247.529691] Unable to handle kernel NULL pointer dereference at virtual address 0000027c ... [ 247.563996] PC is at __mutex_lock_slowpath+0x94/0x3a8 ... [ 247.823025] [] (__mutex_lock_slowpath) from [] (mutex_lock+0x20/0x3c) [ 247.831186] [] (mutex_lock) from [] (drm_framebuffer_cleanup+0x18/0x38) [ 247.839520] [] (drm_framebuffer_cleanup) from [] (msm_framebuffer_destroy+0x48/0x100) [ 247.849066] [] (msm_framebuffer_destroy) from [] (msm_framebuffer_init+0x1e8/0x228) [ 247.858439] [] (msm_framebuffer_init) from [] (msm_framebuffer_create+0x70/0x134) [ 247.867642] [] (msm_framebuffer_create) from [] (internal_framebuffer_create+0x67c/0x7b4) [ 247.877537] [] (internal_framebuffer_create) from [] (drm_mode_addfb2+0x20/0x98) [ 247.886650] [] (drm_mode_addfb2) from [] (drm_ioctl+0x240/0x420) [ 247.894378] [] (drm_ioctl) from [] (do_vfs_ioctl+0x4e4/0x5a4) ... Signed-off-by: Stephane Viau --- drivers/gpu/drm/msm/msm_fb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/gpu/drm/msm/msm_fb.c b/drivers/gpu/drm/msm/msm_fb.c index 6b573e6..c0f09d3 100644 --- a/drivers/gpu/drm/msm/msm_fb.c +++ b/drivers/gpu/drm/msm/msm_fb.c @@ -239,8 +239,7 @@ struct drm_framebuffer *msm_framebuffer_init(struct drm_device *dev, return fb; fail: - if (fb) - msm_framebuffer_destroy(fb); + kfree(msm_fb); return ERR_PTR(ret); } -- Qualcomm Innovation Center, Inc. The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project