From mboxrd@z Thu Jan 1 00:00:00 1970 From: Greg Kroah-Hartman Subject: [PATCH 4.14 038/189] drm/msm: dont deref error pointer in the msm_fbdev_create error path Date: Mon, 18 Jun 2018 10:12:14 +0200 Message-ID: <20180618081210.885917775@linuxfoundation.org> References: <20180618081209.254234434@linuxfoundation.org> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: <20180618081209.254234434-hQyY1W1yCW8ekmWlsbkhG0B+6BGkLq7r@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: freedreno-bounces-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org Sender: "Freedreno" To: linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Cc: Greg Kroah-Hartman , dri-devel-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org, Sasha Levin , Rob Clark , stable-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-arm-msm-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, freedreno-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org, Emil Velikov List-Id: linux-arm-msm@vger.kernel.org NC4xNC1zdGFibGUgcmV2aWV3IHBhdGNoLiAgSWYgYW55b25lIGhhcyBhbnkgb2JqZWN0aW9ucywg cGxlYXNlIGxldCBtZSBrbm93LgoKLS0tLS0tLS0tLS0tLS0tLS0tCgpGcm9tOiBFbWlsIFZlbGlr b3YgPGVtaWwudmVsaWtvdkBjb2xsYWJvcmEuY29tPgoKWyBVcHN0cmVhbSBjb21taXQgNzg5ZDRj MzAwZTEwZWIyMDk2ZWU4M2MzNDk3MTE4ZTY3Y2NjOTUxZSBdCgpDdXJyZW50bHkgdGhlIGVycm9y IHBvaW50ZXIgcmV0dXJuZWQgYnkgbXNtX2FsbG9jX3N0b2xlbl9mYiBnZXRzIHBhc3NlZAp0byBk cm1fZnJhbWVidWZmZXJfcmVtb3ZlLiBUaGUgbGF0dGVyIGhhbmRsZXMgb25seSBOVUxMIHBvaW50 ZXJzLCB0aHVzCmEgbmFzdHkgY3Jhc2ggd2lsbCBvY2N1ci4KCkRyb3AgdGhlIHVubmVjZXNzYXJ5 IGZhaWwgbGFiZWwgYW5kIHRoZSBhc3NvY2lhdGVkIGNoZWNrcyAtIGJvdGggZXJyIGFuZApmYiB3 aWxsIGJlIHNldCBhdCB0aGlzIHN0YWdlLgoKQ2M6IFJvYiBDbGFyayA8cm9iZGNsYXJrQGdtYWls LmNvbT4KQ2M6IGxpbnV4LWFybS1tc21Admdlci5rZXJuZWwub3JnCkNjOiBkcmktZGV2ZWxAbGlz dHMuZnJlZWRlc2t0b3Aub3JnCkNjOiBmcmVlZHJlbm9AbGlzdHMuZnJlZWRlc2t0b3Aub3JnClNp Z25lZC1vZmYtYnk6IEVtaWwgVmVsaWtvdiA8ZW1pbC52ZWxpa292QGNvbGxhYm9yYS5jb20+ClNp Z25lZC1vZmYtYnk6IFJvYiBDbGFyayA8cm9iZGNsYXJrQGdtYWlsLmNvbT4KU2lnbmVkLW9mZi1i eTogU2FzaGEgTGV2aW4gPGFsZXhhbmRlci5sZXZpbkBtaWNyb3NvZnQuY29tPgpTaWduZWQtb2Zm LWJ5OiBHcmVnIEtyb2FoLUhhcnRtYW4gPGdyZWdraEBsaW51eGZvdW5kYXRpb24ub3JnPgotLS0K IGRyaXZlcnMvZ3B1L2RybS9tc20vbXNtX2ZiZGV2LmMgfCAgIDExICsrLS0tLS0tLS0tCiAxIGZp bGUgY2hhbmdlZCwgMiBpbnNlcnRpb25zKCspLCA5IGRlbGV0aW9ucygtKQoKLS0tIGEvZHJpdmVy cy9ncHUvZHJtL21zbS9tc21fZmJkZXYuYworKysgYi9kcml2ZXJzL2dwdS9kcm0vbXNtL21zbV9m YmRldi5jCkBAIC05Miw4ICs5Miw3IEBAIHN0YXRpYyBpbnQgbXNtX2ZiZGV2X2NyZWF0ZShzdHJ1 Y3QgZHJtX2YKIAogCWlmIChJU19FUlIoZmIpKSB7CiAJCWRldl9lcnIoZGV2LT5kZXYsICJmYWls ZWQgdG8gYWxsb2NhdGUgZmJcbiIpOwotCQlyZXQgPSBQVFJfRVJSKGZiKTsKLQkJZ290byBmYWls OworCQlyZXR1cm4gUFRSX0VSUihmYik7CiAJfQogCiAJYm8gPSBtc21fZnJhbWVidWZmZXJfYm8o ZmIsIDApOwpAQCAtMTUxLDEzICsxNTAsNyBAQCBzdGF0aWMgaW50IG1zbV9mYmRldl9jcmVhdGUo c3RydWN0IGRybV9mCiAKIGZhaWxfdW5sb2NrOgogCW11dGV4X3VubG9jaygmZGV2LT5zdHJ1Y3Rf bXV0ZXgpOwotZmFpbDoKLQotCWlmIChyZXQpIHsKLQkJaWYgKGZiKQotCQkJZHJtX2ZyYW1lYnVm ZmVyX3JlbW92ZShmYik7Ci0JfQotCisJZHJtX2ZyYW1lYnVmZmVyX3JlbW92ZShmYik7CiAJcmV0 dXJuIHJldDsKIH0KIAoKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fCkZyZWVkcmVubyBtYWlsaW5nIGxpc3QKRnJlZWRyZW5vQGxpc3RzLmZyZWVkZXNrdG9w Lm9yZwpodHRwczovL2xpc3RzLmZyZWVkZXNrdG9wLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2ZyZWVk cmVubwo= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3A84FC433EF for ; Mon, 18 Jun 2018 08:30:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E91BB20864 for ; Mon, 18 Jun 2018 08:30:40 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E91BB20864 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linuxfoundation.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S967003AbeFRIai (ORCPT ); Mon, 18 Jun 2018 04:30:38 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:33724 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S966982AbeFRIae (ORCPT ); Mon, 18 Jun 2018 04:30:34 -0400 Received: from localhost (LFbn-1-12247-202.w90-92.abo.wanadoo.fr [90.92.61.202]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 299A6C83; Mon, 18 Jun 2018 08:30:34 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rob Clark , linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, freedreno@lists.freedesktop.org, Emil Velikov , Sasha Levin Subject: [PATCH 4.14 038/189] drm/msm: dont deref error pointer in the msm_fbdev_create error path Date: Mon, 18 Jun 2018 10:12:14 +0200 Message-Id: <20180618081210.885917775@linuxfoundation.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180618081209.254234434@linuxfoundation.org> References: <20180618081209.254234434@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Emil Velikov [ Upstream commit 789d4c300e10eb2096ee83c3497118e67ccc951e ] Currently the error pointer returned by msm_alloc_stolen_fb gets passed to drm_framebuffer_remove. The latter handles only NULL pointers, thus a nasty crash will occur. Drop the unnecessary fail label and the associated checks - both err and fb will be set at this stage. Cc: Rob Clark Cc: linux-arm-msm@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: freedreno@lists.freedesktop.org Signed-off-by: Emil Velikov Signed-off-by: Rob Clark Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/msm/msm_fbdev.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) --- a/drivers/gpu/drm/msm/msm_fbdev.c +++ b/drivers/gpu/drm/msm/msm_fbdev.c @@ -92,8 +92,7 @@ static int msm_fbdev_create(struct drm_f if (IS_ERR(fb)) { dev_err(dev->dev, "failed to allocate fb\n"); - ret = PTR_ERR(fb); - goto fail; + return PTR_ERR(fb); } bo = msm_framebuffer_bo(fb, 0); @@ -151,13 +150,7 @@ static int msm_fbdev_create(struct drm_f fail_unlock: mutex_unlock(&dev->struct_mutex); -fail: - - if (ret) { - if (fb) - drm_framebuffer_remove(fb); - } - + drm_framebuffer_remove(fb); return ret; }