Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
drm/gem: Correct error condition in drm_gem_objects_lookup
When vmemdup_array_user() fails, 'handles' is set to a negative error
code and no memory is allocated. So the call to kvfree() should not
happen. Instead just return early with the error code.
Fixes: cb77b79abf5f ("drm/gem: Use vmemdup_array_user in drm_gem_objects_lookup")
Signed-off-by: Steven Price <steven.price@arm.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Link: https://patch.msgid.link/20251124112039.117748-1-steven.price@arm.com
+2
-5
+2
-5
drivers/gpu/drm/drm_gem.c
+2
-5
drivers/gpu/drm/drm_gem.c
···
798
798
*objs_out = objs;
799
799
800
800
handles = vmemdup_array_user(bo_handles, count, sizeof(u32));
801
-
if (IS_ERR(handles)) {
802
-
ret = PTR_ERR(handles);
803
-
goto out;
804
-
}
801
+
if (IS_ERR(handles))
802
+
return PTR_ERR(handles);
805
803
806
804
ret = objects_lookup(filp, handles, count, objs);
807
-
out:
808
805
kvfree(handles);
809
806
return ret;
810
807