* Coverity: drm_gem_fb_create_with_funcs(): Memory - corruptions
@ 2020-04-15 15:54 coverity-bot
2020-04-15 17:19 ` [PATCH] drm: Don't free a struct never allocated by drm_gem_fb_init() Andrzej Pietrasiewicz
0 siblings, 1 reply; 3+ messages in thread
From: coverity-bot @ 2020-04-15 15:54 UTC (permalink / raw)
To: Andrzej Pietrasiewicz
Cc: Daniel Vetter, Emil Velikov, James Qian Wang, Gustavo A. R. Silva,
linux-next
Hello!
This is an experimental semi-automated report about issues detected by
Coverity from a scan of next-20200415 as part of the linux-next scan project:
https://scan.coverity.com/projects/linux-next-weekly-scan
You're getting this email because you were associated with the identified
lines of code (noted below) that were touched by commits:
Wed Mar 11 15:55:36 2020 +0100
f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer")
Coverity reported the following:
*** CID 1492613: Memory - corruptions (USE_AFTER_FREE)
/drivers/gpu/drm/drm_gem_framebuffer_helper.c: 230 in drm_gem_fb_create_with_funcs()
224 fb = kzalloc(sizeof(*fb), GFP_KERNEL);
225 if (!fb)
226 return ERR_PTR(-ENOMEM);
227
228 ret = drm_gem_fb_init_with_funcs(dev, fb, file, mode_cmd, funcs);
229 if (ret) {
vvv CID 1492613: Memory - corruptions (USE_AFTER_FREE)
vvv Calling "kfree" frees pointer "fb" which has already been freed. [Note: The source code implementation of the function has been overridden by a user model.]
230 kfree(fb);
231 return ERR_PTR(ret);
232 }
233
234 return fb;
235 }
If this is a false positive, please let us know so we can mark it as
such, or teach the Coverity rules to be smarter. If not, please make
sure fixes get into linux-next. :) For patches fixing this, please
include these lines (but double-check the "Fixes" first):
Edit by human, double checking context:
drm_gem_fb_init_with_funcs() calls drm_gem_fb_init()
drm_gem_fb_init() calls kfree(fb)
Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1492613 ("Memory - corruptions")
Fixes: f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer")
Thanks for your attention!
--
Coverity-bot
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] drm: Don't free a struct never allocated by drm_gem_fb_init()
2020-04-15 15:54 Coverity: drm_gem_fb_create_with_funcs(): Memory - corruptions coverity-bot
@ 2020-04-15 17:19 ` Andrzej Pietrasiewicz
2020-04-15 18:33 ` Daniel Vetter
0 siblings, 1 reply; 3+ messages in thread
From: Andrzej Pietrasiewicz @ 2020-04-15 17:19 UTC (permalink / raw)
To: dri-devel
Cc: Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Daniel Vetter, James Qian Wang, Gustavo A . R . Silva, linux-next,
Emil Velikov, kernel
drm_gem_fb_init() is passed the fb and never allocates it, so it should be
not the one freeing it. As it is now the second call to kfree() is possible
with the same fb. Coverity reported the following:
*** CID 1492613: Memory - corruptions (USE_AFTER_FREE)
/drivers/gpu/drm/drm_gem_framebuffer_helper.c: 230 in drm_gem_fb_create_with_funcs()
224 fb = kzalloc(sizeof(*fb), GFP_KERNEL);
225 if (!fb)
226 return ERR_PTR(-ENOMEM);
227
228 ret = drm_gem_fb_init_with_funcs(dev, fb, file, mode_cmd, funcs);
229 if (ret) {
vvv CID 1492613: Memory - corruptions (USE_AFTER_FREE)
vvv Calling "kfree" frees pointer "fb" which has already been freed. [Note: The source code implementation of the function has been overridden by a user model.]
230 kfree(fb);
231 return ERR_PTR(ret);
232 }
233
234 return fb;
235 }
drm_gem_fb_init_with_funcs() calls drm_gem_fb_init()
drm_gem_fb_init() calls kfree(fb)
Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1492613 ("Memory - corruptions")
Fixes: f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer")
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
---
drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem_framebuffer_helper.c b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
index cac15294aef6..ccc2c71fa491 100644
--- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c
+++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
@@ -76,10 +76,8 @@ drm_gem_fb_init(struct drm_device *dev,
fb->obj[i] = obj[i];
ret = drm_framebuffer_init(dev, fb, funcs);
- if (ret) {
+ if (ret)
drm_err(dev, "Failed to init framebuffer: %d\n", ret);
- kfree(fb);
- }
return ret;
}
--
2.17.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] drm: Don't free a struct never allocated by drm_gem_fb_init()
2020-04-15 17:19 ` [PATCH] drm: Don't free a struct never allocated by drm_gem_fb_init() Andrzej Pietrasiewicz
@ 2020-04-15 18:33 ` Daniel Vetter
0 siblings, 0 replies; 3+ messages in thread
From: Daniel Vetter @ 2020-04-15 18:33 UTC (permalink / raw)
To: Andrzej Pietrasiewicz
Cc: dri-devel, Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann,
David Airlie, James Qian Wang, Gustavo A . R . Silva, linux-next,
Emil Velikov, kernel
On Wed, Apr 15, 2020 at 7:19 PM Andrzej Pietrasiewicz
<andrzej.p@collabora.com> wrote:
>
> drm_gem_fb_init() is passed the fb and never allocates it, so it should be
> not the one freeing it. As it is now the second call to kfree() is possible
> with the same fb. Coverity reported the following:
>
> *** CID 1492613: Memory - corruptions (USE_AFTER_FREE)
> /drivers/gpu/drm/drm_gem_framebuffer_helper.c: 230 in drm_gem_fb_create_with_funcs()
> 224 fb = kzalloc(sizeof(*fb), GFP_KERNEL);
> 225 if (!fb)
> 226 return ERR_PTR(-ENOMEM);
> 227
> 228 ret = drm_gem_fb_init_with_funcs(dev, fb, file, mode_cmd, funcs);
> 229 if (ret) {
> vvv CID 1492613: Memory - corruptions (USE_AFTER_FREE)
> vvv Calling "kfree" frees pointer "fb" which has already been freed. [Note: The source code implementation of the function has been overridden by a user model.]
> 230 kfree(fb);
> 231 return ERR_PTR(ret);
> 232 }
> 233
> 234 return fb;
> 235 }
>
> drm_gem_fb_init_with_funcs() calls drm_gem_fb_init()
> drm_gem_fb_init() calls kfree(fb)
>
> Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
> Addresses-Coverity-ID: 1492613 ("Memory - corruptions")
> Fixes: f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer")
> Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> ---
> drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_gem_framebuffer_helper.c b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
> index cac15294aef6..ccc2c71fa491 100644
> --- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c
> +++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
> @@ -76,10 +76,8 @@ drm_gem_fb_init(struct drm_device *dev,
> fb->obj[i] = obj[i];
>
> ret = drm_framebuffer_init(dev, fb, funcs);
> - if (ret) {
> + if (ret)
> drm_err(dev, "Failed to init framebuffer: %d\n", ret);
> - kfree(fb);
> - }
>
> return ret;
> }
> --
> 2.17.1
>
--
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-04-15 19:06 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-04-15 15:54 Coverity: drm_gem_fb_create_with_funcs(): Memory - corruptions coverity-bot
2020-04-15 17:19 ` [PATCH] drm: Don't free a struct never allocated by drm_gem_fb_init() Andrzej Pietrasiewicz
2020-04-15 18:33 ` Daniel Vetter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).