diff options
author | Tom Rix <trix@redhat.com> | 2020-07-06 05:28:57 -0700 |
---|---|---|
committer | Alex Deucher <alexander.deucher@amd.com> | 2020-07-09 14:42:49 -0400 |
commit | 41855a898650803e24b284173354cc3e44d07725 (patch) | |
tree | 87b5d139c438aa48167656a723072aeca46c1fc8 /drivers/nvdimm/blk.c | |
parent | 3b2e973dff59d88bee1d814ddf8762a24fc02b60 (diff) | |
download | lwn-41855a898650803e24b284173354cc3e44d07725.tar.gz lwn-41855a898650803e24b284173354cc3e44d07725.zip |
drm/radeon: fix double free
clang static analysis flags this error
drivers/gpu/drm/radeon/ci_dpm.c:5652:9: warning: Use of memory after it is freed [unix.Malloc]
kfree(rdev->pm.dpm.ps[i].ps_priv);
^~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/radeon/ci_dpm.c:5654:2: warning: Attempt to free released memory [unix.Malloc]
kfree(rdev->pm.dpm.ps);
^~~~~~~~~~~~~~~~~~~~~~
problem is reported in ci_dpm_fini, with these code blocks.
for (i = 0; i < rdev->pm.dpm.num_ps; i++) {
kfree(rdev->pm.dpm.ps[i].ps_priv);
}
kfree(rdev->pm.dpm.ps);
The first free happens in ci_parse_power_table where it cleans up locally
on a failure. ci_dpm_fini also does a cleanup.
ret = ci_parse_power_table(rdev);
if (ret) {
ci_dpm_fini(rdev);
return ret;
}
So remove the cleanup in ci_parse_power_table and
move the num_ps calculation to inside the loop so ci_dpm_fini
will know how many array elements to free.
Fixes: cc8dbbb4f62a ("drm/radeon: add dpm support for CI dGPUs (v2)")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Diffstat (limited to 'drivers/nvdimm/blk.c')
0 files changed, 0 insertions, 0 deletions