* [PATCH] drm/virtio: Fix a double free in virtio_gpu_cmd_map()
@ 2020-10-30 11:48 ` Dan Carpenter
0 siblings, 0 replies; 7+ messages in thread
From: Dan Carpenter @ 2020-10-30 11:48 UTC (permalink / raw)
To: David Airlie, Gerd Hoffmann
Cc: Tomeu Vizoso, kernel-janitors, dri-devel, virtualization,
Gurchetan Singh
This is freed both here and in the caller (virtio_gpu_vram_map()) so
it's a double free. The correct place is only in the caller.
Fixes: 16845c5d5409 ("drm/virtio: implement blob resources: implement vram object")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/gpu/drm/virtio/virtgpu_vq.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index 72586cd8cc4c..3f200306c9d7 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -1212,10 +1212,8 @@ int virtio_gpu_cmd_map(struct virtio_gpu_device *vgdev,
struct virtio_gpu_resp_map_info *resp_buf;
resp_buf = kzalloc(sizeof(*resp_buf), GFP_KERNEL);
- if (!resp_buf) {
- virtio_gpu_array_put_free(objs);
+ if (!resp_buf)
return -ENOMEM;
- }
cmd_p = virtio_gpu_alloc_cmd_resp
(vgdev, virtio_gpu_cmd_resource_map_cb, &vbuf, sizeof(*cmd_p),
--
2.28.0
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH] drm/virtio: Fix a double free in virtio_gpu_cmd_map()
@ 2020-10-30 11:48 ` Dan Carpenter
0 siblings, 0 replies; 7+ messages in thread
From: Dan Carpenter @ 2020-10-30 11:48 UTC (permalink / raw)
To: David Airlie, Gerd Hoffmann
Cc: Tomeu Vizoso, kernel-janitors, dri-devel, virtualization,
Daniel Vetter, Gurchetan Singh
This is freed both here and in the caller (virtio_gpu_vram_map()) so
it's a double free. The correct place is only in the caller.
Fixes: 16845c5d5409 ("drm/virtio: implement blob resources: implement vram object")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/gpu/drm/virtio/virtgpu_vq.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index 72586cd8cc4c..3f200306c9d7 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -1212,10 +1212,8 @@ int virtio_gpu_cmd_map(struct virtio_gpu_device *vgdev,
struct virtio_gpu_resp_map_info *resp_buf;
resp_buf = kzalloc(sizeof(*resp_buf), GFP_KERNEL);
- if (!resp_buf) {
- virtio_gpu_array_put_free(objs);
+ if (!resp_buf)
return -ENOMEM;
- }
cmd_p = virtio_gpu_alloc_cmd_resp
(vgdev, virtio_gpu_cmd_resource_map_cb, &vbuf, sizeof(*cmd_p),
--
2.28.0
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH] drm/virtio: Fix a double free in virtio_gpu_cmd_map()
2020-10-30 11:48 ` Dan Carpenter
(?)
(?)
@ 2020-11-06 1:28 ` Gurchetan Singh
-1 siblings, 0 replies; 7+ messages in thread
From: Gurchetan Singh @ 2020-11-06 1:28 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Gerd Hoffmann, ML dri-devel
[-- Attachment #1.1: Type: text/plain, Size: 1243 bytes --]
On Fri, Oct 30, 2020 at 4:48 AM Dan Carpenter <dan.carpenter@oracle.com>
wrote:
> This is freed both here and in the caller (virtio_gpu_vram_map()) so
> it's a double free. The correct place is only in the caller.
>
> Fixes: 16845c5d5409 ("drm/virtio: implement blob resources: implement vram
> object")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/gpu/drm/virtio/virtgpu_vq.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c
> b/drivers/gpu/drm/virtio/virtgpu_vq.c
> index 72586cd8cc4c..3f200306c9d7 100644
> --- a/drivers/gpu/drm/virtio/virtgpu_vq.c
> +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
> @@ -1212,10 +1212,8 @@ int virtio_gpu_cmd_map(struct virtio_gpu_device
> *vgdev,
> struct virtio_gpu_resp_map_info *resp_buf;
>
> resp_buf = kzalloc(sizeof(*resp_buf), GFP_KERNEL);
> - if (!resp_buf) {
> - virtio_gpu_array_put_free(objs);
> + if (!resp_buf)
> return -ENOMEM;
> - }
>
> cmd_p = virtio_gpu_alloc_cmd_resp
> (vgdev, virtio_gpu_cmd_resource_map_cb, &vbuf,
> sizeof(*cmd_p),
> --
> 2.28.0
>
Reviewed-by: Gurchetan Singh <gurchetansingh@chromium.org>
[-- Attachment #1.2: Type: text/html, Size: 1847 bytes --]
[-- Attachment #2: Type: text/plain, Size: 160 bytes --]
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] drm/virtio: Fix a double free in virtio_gpu_cmd_map()
2020-10-30 11:48 ` Dan Carpenter
(?)
@ 2020-11-06 8:25 ` Gerd Hoffmann
-1 siblings, 0 replies; 7+ messages in thread
From: Gerd Hoffmann @ 2020-11-06 8:25 UTC (permalink / raw)
To: Dan Carpenter
Cc: Tomeu Vizoso, David Airlie, kernel-janitors, dri-devel,
virtualization, Gurchetan Singh
On Fri, Oct 30, 2020 at 02:48:08PM +0300, Dan Carpenter wrote:
> This is freed both here and in the caller (virtio_gpu_vram_map()) so
> it's a double free. The correct place is only in the caller.
>
> Fixes: 16845c5d5409 ("drm/virtio: implement blob resources: implement vram object")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Pushed to drm-misc-next.
thanks,
Gerd
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] drm/virtio: Fix a double free in virtio_gpu_cmd_map()
@ 2020-11-06 8:25 ` Gerd Hoffmann
0 siblings, 0 replies; 7+ messages in thread
From: Gerd Hoffmann @ 2020-11-06 8:25 UTC (permalink / raw)
To: Dan Carpenter
Cc: Tomeu Vizoso, David Airlie, kernel-janitors, dri-devel,
virtualization, Gurchetan Singh
On Fri, Oct 30, 2020 at 02:48:08PM +0300, Dan Carpenter wrote:
> This is freed both here and in the caller (virtio_gpu_vram_map()) so
> it's a double free. The correct place is only in the caller.
>
> Fixes: 16845c5d5409 ("drm/virtio: implement blob resources: implement vram object")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Pushed to drm-misc-next.
thanks,
Gerd
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] drm/virtio: Fix a double free in virtio_gpu_cmd_map()
@ 2020-11-06 8:25 ` Gerd Hoffmann
0 siblings, 0 replies; 7+ messages in thread
From: Gerd Hoffmann @ 2020-11-06 8:25 UTC (permalink / raw)
To: Dan Carpenter
Cc: Tomeu Vizoso, David Airlie, kernel-janitors, dri-devel,
virtualization, Daniel Vetter, Gurchetan Singh
On Fri, Oct 30, 2020 at 02:48:08PM +0300, Dan Carpenter wrote:
> This is freed both here and in the caller (virtio_gpu_vram_map()) so
> it's a double free. The correct place is only in the caller.
>
> Fixes: 16845c5d5409 ("drm/virtio: implement blob resources: implement vram object")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Pushed to drm-misc-next.
thanks,
Gerd
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply [flat|nested] 7+ messages in thread