tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/vkms: Fix use after frees on error paths

These error paths free a pointer and then dereference it on the next line
to get the error code. Save the error code first and then free the
memory.

Fixes: 3e4d5b30d2b2 ("drm/vkms: Allow to configure multiple CRTCs via configfs")
Fixes: 2f1734ba271b ("drm/vkms: Allow to configure multiple planes via configfs")
Fixes: 67d8cf92e13e ("drm/vkms: Allow to configure multiple encoders via configfs")
Fixes: 272acbca96a3 ("drm/vkms: Allow to configure multiple connectors via configfs")
Fixes: 13fc9b9745cc ("drm/vkms: Add and remove VKMS instances via configfs")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: José Expósito <jose.exposito89@gmail.com>
Link: https://lore.kernel.org/r/aPtfy2jCI_kb3Df7@stanley.mountain
Signed-off-by: Louis Chauvet <louis.chauvet@bootlin.com>

authored by

Dan Carpenter and committed by
Louis Chauvet f9e46acc 71829d7f

+15 -5
+15 -5
drivers/gpu/drm/vkms/vkms_configfs.c
··· 204 204 { 205 205 struct vkms_configfs_device *dev; 206 206 struct vkms_configfs_crtc *crtc; 207 + int ret; 207 208 208 209 dev = child_group_to_vkms_configfs_device(group); 209 210 ··· 220 219 221 220 crtc->config = vkms_config_create_crtc(dev->config); 222 221 if (IS_ERR(crtc->config)) { 222 + ret = PTR_ERR(crtc->config); 223 223 kfree(crtc); 224 - return ERR_CAST(crtc->config); 224 + return ERR_PTR(ret); 225 225 } 226 226 227 227 config_group_init_type_name(&crtc->group, name, &crtc_item_type); ··· 360 358 { 361 359 struct vkms_configfs_device *dev; 362 360 struct vkms_configfs_plane *plane; 361 + int ret; 363 362 364 363 dev = child_group_to_vkms_configfs_device(group); 365 364 ··· 376 373 377 374 plane->config = vkms_config_create_plane(dev->config); 378 375 if (IS_ERR(plane->config)) { 376 + ret = PTR_ERR(plane->config); 379 377 kfree(plane); 380 - return ERR_CAST(plane->config); 378 + return ERR_PTR(ret); 381 379 } 382 380 383 381 config_group_init_type_name(&plane->group, name, &plane_item_type); ··· 476 472 { 477 473 struct vkms_configfs_device *dev; 478 474 struct vkms_configfs_encoder *encoder; 475 + int ret; 479 476 480 477 dev = child_group_to_vkms_configfs_device(group); 481 478 ··· 492 487 493 488 encoder->config = vkms_config_create_encoder(dev->config); 494 489 if (IS_ERR(encoder->config)) { 490 + ret = PTR_ERR(encoder->config); 495 491 kfree(encoder); 496 - return ERR_CAST(encoder->config); 492 + return ERR_PTR(ret); 497 493 } 498 494 499 495 config_group_init_type_name(&encoder->group, name, ··· 643 637 { 644 638 struct vkms_configfs_device *dev; 645 639 struct vkms_configfs_connector *connector; 640 + int ret; 646 641 647 642 dev = child_group_to_vkms_configfs_device(group); 648 643 ··· 659 652 660 653 connector->config = vkms_config_create_connector(dev->config); 661 654 if (IS_ERR(connector->config)) { 655 + ret = PTR_ERR(connector->config); 662 656 kfree(connector); 663 - return ERR_CAST(connector->config); 657 + return ERR_PTR(ret); 664 658 } 665 659 666 660 config_group_init_type_name(&connector->group, name, ··· 764 756 const char *name) 765 757 { 766 758 struct vkms_configfs_device *dev; 759 + int ret; 767 760 768 761 if (strcmp(name, DEFAULT_DEVICE_NAME) == 0) 769 762 return ERR_PTR(-EINVAL); ··· 775 766 776 767 dev->config = vkms_config_create(name); 777 768 if (IS_ERR(dev->config)) { 769 + ret = PTR_ERR(dev->config); 778 770 kfree(dev); 779 - return ERR_CAST(dev->config); 771 + return ERR_PTR(ret); 780 772 } 781 773 782 774 config_group_init_type_name(&dev->group, name, &device_item_type);