From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tomi Valkeinen Subject: Re: [PATCH 10/15] drm: omapdrm: gem: Free the correct memory object Date: Mon, 14 Dec 2015 13:45:44 +0200 Message-ID: <566EABE8.8060808@ti.com> References: <1449268039-24682-1-git-send-email-laurent.pinchart@ideasonboard.com> <1449268039-24682-11-git-send-email-laurent.pinchart@ideasonboard.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2020318035==" Return-path: Received: from arroyo.ext.ti.com (arroyo.ext.ti.com [192.94.94.40]) by gabe.freedesktop.org (Postfix) with ESMTPS id AE7026E632 for ; Mon, 14 Dec 2015 03:46:51 -0800 (PST) In-Reply-To: <1449268039-24682-11-git-send-email-laurent.pinchart@ideasonboard.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Laurent Pinchart , dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org --===============2020318035== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="lakWifWrbXcHka72kLIVf6DsvHWT3DNAA" --lakWifWrbXcHka72kLIVf6DsvHWT3DNAA Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 05/12/15 00:27, Laurent Pinchart wrote: > The GEM object free handler frees memory allocated by the driver using > the pointer to the drm_gem_object instead of the pointer to the > omap_gem_object that embeds it. This doesn't cause any issue in practic= e > as the drm_gem_object is the first field of omap_gem_object, but would > cause memory corruption if the structure layout changes. Fix it. >=20 > Signed-off-by: Laurent Pinchart > --- > drivers/gpu/drm/omapdrm/omap_gem.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) >=20 > diff --git a/drivers/gpu/drm/omapdrm/omap_gem.c b/drivers/gpu/drm/omapd= rm/omap_gem.c > index 644dff8ab516..f24bb71d9946 100644 > --- a/drivers/gpu/drm/omapdrm/omap_gem.c > +++ b/drivers/gpu/drm/omapdrm/omap_gem.c > @@ -1336,7 +1336,7 @@ void omap_gem_free_object(struct drm_gem_object *= obj) > =20 > drm_gem_object_release(obj); > =20 > - kfree(obj); > + kfree(omap_obj); > } > =20 > /* GEM buffer object constructor */ >=20 There's another kfree(obj) in omap_gem_new_handle(). Tomi --lakWifWrbXcHka72kLIVf6DsvHWT3DNAA Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWbqwkAAoJEPo9qoy8lh71xukP/Rx60EGVDA/JPEC5JNSr7UHJ PPjK+CCsEXfTVz2PWt5JJwuAJYdL5mEX1jlEgEiqwzGQdTltwSe2+umDOAry+ava 8fZKzVGX+DsaZQKnpd+gw/9PZM91eHsgY0fQLIVHfcdWF/2FKsZkATSd+Euu+HZs SG+TRyG2EMmW5Cj3JSHem3gSvK8sd64CeizuCk3/B9Kjmc95gMrdEx96Q+S2kEOn HUfIOV6Ibm9mvOWvSlQFCxYSVtVi1CpC4FzEVV7ATqYp50eAsELPLmyWGhxAvRXA Zjs93r6hOVGSCw4DY6cOCfEhm8iU2/DLw1zavKGYyhzyJZkaiG5qCEoLfiBnShuR 7r1nRhewYZbJvTTC2SBsy/7xhU1TxTEmGzSK79N9zIrZKrquhiygyBnsfqBruZxe dO2Y1XuDrmhSEDtpP3i1x1cfBoQXx+UGs0K3iA5PuwA6jtKLr30BKKv7P8yfNfv4 Hvd9oqfpB0HN6f/wzuSZ9NqhNaet7nTKcum3ou9zs/IQdPPX7NAFBMNnOh9GpfxG o+5TjWtiF+SgfCGyPIQvEF1NNp7yfGgJiFLMP1qm+tloo4Uq3Zla1RXf0TY/6Xzw CU5LH5P4uxIpc56bisw8h+xUCHTDPAcBs/t3KbGVxDpjDntHtFySTAuW8lyKRFLm j1sQcToSl+OEJ507VkJ1 =x42F -----END PGP SIGNATURE----- --lakWifWrbXcHka72kLIVf6DsvHWT3DNAA-- --===============2020318035== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVs IG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHA6Ly9saXN0 cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0aW5mby9kcmktZGV2ZWwK --===============2020318035==--