OSDN Git Service

drm/gem: Fix a leak in drm_gem_objects_lookup()
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 20 Mar 2020 13:23:34 +0000 (16:23 +0300)
committerEmil Velikov <emil.l.velikov@gmail.com>
Sun, 17 May 2020 16:14:38 +0000 (17:14 +0100)
If the "handles" allocation or the copy_from_user() fails then we leak
"objs".  It's supposed to be freed in panfrost_job_cleanup().

Fixes: c117aa4d8701 ("drm: Add a drm_gem_objects_lookup helper")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200320132334.GC95012@mwanda
drivers/gpu/drm/drm_gem.c

index 7bf628e..d6ef48b 100644 (file)
@@ -709,6 +709,8 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles,
        if (!objs)
                return -ENOMEM;
 
+       *objs_out = objs;
+
        handles = kvmalloc_array(count, sizeof(u32), GFP_KERNEL);
        if (!handles) {
                ret = -ENOMEM;
@@ -722,8 +724,6 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles,
        }
 
        ret = objects_lookup(filp, handles, count, objs);
-       *objs_out = objs;
-
 out:
        kvfree(handles);
        return ret;