]> git.baikalelectronics.ru Git - kernel.git/commit
drm/radeon: fix double free
authorTom Rix <trix@redhat.com>
Mon, 6 Jul 2020 12:28:57 +0000 (05:28 -0700)
committerAlex Deucher <alexander.deucher@amd.com>
Thu, 9 Jul 2020 18:42:49 +0000 (14:42 -0400)
commit5fc088ad15902c6d5ca67238453ecd0a8a86253e
tree87b5d139c438aa48167656a723072aeca46c1fc8
parent40421e81a5a7672d9b28e5a0e981c12b9df2079f
drm/radeon: fix double free

clang static analysis flags this error

drivers/gpu/drm/radeon/ci_dpm.c:5652:9: warning: Use of memory after it is freed [unix.Malloc]
                kfree(rdev->pm.dpm.ps[i].ps_priv);
                      ^~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/radeon/ci_dpm.c:5654:2: warning: Attempt to free released memory [unix.Malloc]
        kfree(rdev->pm.dpm.ps);
        ^~~~~~~~~~~~~~~~~~~~~~

problem is reported in ci_dpm_fini, with these code blocks.

for (i = 0; i < rdev->pm.dpm.num_ps; i++) {
kfree(rdev->pm.dpm.ps[i].ps_priv);
}
kfree(rdev->pm.dpm.ps);

The first free happens in ci_parse_power_table where it cleans up locally
on a failure.  ci_dpm_fini also does a cleanup.

ret = ci_parse_power_table(rdev);
if (ret) {
ci_dpm_fini(rdev);
return ret;
}

So remove the cleanup in ci_parse_power_table and
move the num_ps calculation to inside the loop so ci_dpm_fini
will know how many array elements to free.

Fixes: 7c04e1dfcee1 ("drm/radeon: add dpm support for CI dGPUs (v2)")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
drivers/gpu/drm/radeon/ci_dpm.c