[bug report] drm/amdgpu: fix memleak in pptable_init

[bug report] drm/amdgpu: fix memleak in pptable_init

[Dan Carpenter]

Hello Monk Liu,

The patch 9d8f086cd059: "drm/amdgpu: fix memleak in pptable_init"
from May 30, 2016, leads to the following static checker warning:

	drivers/gpu/drm/amd/amdgpu/../powerplay/amd_powerplay.c:107 pp_sw_fini()
	error: dereferencing freed memory 'hwmgr'

drivers/gpu/drm/amd/amdgpu/../powerplay/amd_powerplay.c
    90  static int pp_sw_fini(void *handle)
    91  {
    92          struct pp_instance *pp_handle;
    93          struct pp_hwmgr  *hwmgr;
    94          int ret = 0;
    95  
    96          if (handle == NULL)
    97                  return -EINVAL;
    98  
    99          pp_handle = (struct pp_instance *)handle;
   100          hwmgr = pp_handle->hwmgr;
   101  
   102          PP_CHECK_HW(hwmgr);
   103  
   104          if (hwmgr->hwmgr_func->backend_fini != NULL)
   105                  ret = hwmgr->hwmgr_func->backend_fini(hwmgr);

The cz_hwmgr_backend_fini() function frees "hwmgr".

   106  
   107          if (hwmgr->pptable_func->pptable_fini)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

But we dereference it on the next line which won't work.

   108                  hwmgr->pptable_func->pptable_fini(hwmgr);
   109  
   110          return ret;
   111  }

regards,
dan carpenter
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [bug report] drm/amdgpu: fix memleak in pptable_init

[Dan Carpenter]

Ping?

regards,
dan carpenter

On Wed, Nov 30, 2016 at 10:18:41PM +0300, Dan Carpenter wrote:
> Hello Monk Liu,
> 
> The patch 9d8f086cd059: "drm/amdgpu: fix memleak in pptable_init"
> from May 30, 2016, leads to the following static checker warning:
> 
> 	drivers/gpu/drm/amd/amdgpu/../powerplay/amd_powerplay.c:107 pp_sw_fini()
> 	error: dereferencing freed memory 'hwmgr'
> 
> drivers/gpu/drm/amd/amdgpu/../powerplay/amd_powerplay.c
>     90  static int pp_sw_fini(void *handle)
>     91  {
>     92          struct pp_instance *pp_handle;
>     93          struct pp_hwmgr  *hwmgr;
>     94          int ret = 0;
>     95  
>     96          if (handle == NULL)
>     97                  return -EINVAL;
>     98  
>     99          pp_handle = (struct pp_instance *)handle;
>    100          hwmgr = pp_handle->hwmgr;
>    101  
>    102          PP_CHECK_HW(hwmgr);
>    103  
>    104          if (hwmgr->hwmgr_func->backend_fini != NULL)
>    105                  ret = hwmgr->hwmgr_func->backend_fini(hwmgr);
> 
> The cz_hwmgr_backend_fini() function frees "hwmgr".
> 
>    106  
>    107          if (hwmgr->pptable_func->pptable_fini)
>                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
> But we dereference it on the next line which won't work.
> 
>    108                  hwmgr->pptable_func->pptable_fini(hwmgr);
>    109  
>    110          return ret;
>    111  }
> 
> regards,
> dan carpenter
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel