From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: re: gma500: introduce the framebuffer support code Date: Wed, 15 Oct 2014 16:29:46 +0300 Message-ID: <20141015132945.GA7539@mwanda> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by gabe.freedesktop.org (Postfix) with ESMTP id E445F6E12B for ; Wed, 15 Oct 2014 06:30:11 -0700 (PDT) Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: alan@linux.intel.com Cc: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org Hello Alan Cox, The patch 4d8d096e9ae8: "gma500: introduce the framebuffer support code" from Nov 3, 2011, leads to the following static checker warning: drivers/gpu/drm/gma500/framebuffer.c:488 psbfb_create() warning: passing freed memory 'backing' drivers/gpu/drm/gma500/framebuffer.c 481 out_unref: 482 if (backing->stolen) 483 psb_gtt_free_range(dev, backing); ^^^^^^^ This function always frees backing. 484 else 485 drm_gem_object_unreference(&backing->gem); 486 out_err1: 487 mutex_unlock(&dev->struct_mutex); 488 psb_gtt_free_range(dev, backing); ^^^^^^^ Double free. 489 return ret; 490 } regards, dan carpenter