Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

msm: mdss: Fix double free during probe fail 

Memory allocated with "devm_kzalloc" is automatically released
by the kernel if the "probe" function fails with an error code.
Therefore, using "kfree" is unsafe because it can lead to the Double-Free.

Change-Id: Ic9285ebbd7d246e275a93cde4d03656d99d5ea3d
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
This commit is contained in:
raghavendra ambadas 2018-06-04 10:56:52 +05:30 committed by syphyr
parent e91c373da7
commit 3c7690512e
1 changed files with 5 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
drivers/video/msm/mdss/mdss_mdp.c
View File

@ -1,7 +1,7 @@
/*
* MDSS MDP Interface (used by framebuffer core)
*
* Copyright (c) 2007-2017, The Linux Foundation. All rights reserved.
* Copyright (c) 2007-2018, The Linux Foundation. All rights reserved.
* Copyright (C) 2007 Google Incorporated
*
* This software is licensed under the terms of the GNU General Public
@ -2287,7 +2287,7 @@ static int mdss_mdp_parse_dt_pipe(struct platform_device *pdev)
if (!mdata->vig_pipes) {
pr_err("no mem for vig_pipes: kzalloc fail\n");
rc = -ENOMEM;
goto vig_alloc_fail;
goto parse_fail;
}
mdata->rgb_pipes = devm_kzalloc(&mdata->pdev->dev,
@ -2295,7 +2295,7 @@ static int mdss_mdp_parse_dt_pipe(struct platform_device *pdev)
if (!mdata->rgb_pipes) {
pr_err("no mem for rgb_pipes: kzalloc fail\n");
rc = -ENOMEM;
goto rgb_alloc_fail;
goto parse_fail;
}
if (mdata->ndma_pipes) {
@ -2305,7 +2305,7 @@ static int mdss_mdp_parse_dt_pipe(struct platform_device *pdev)
if (!mdata->dma_pipes) {
pr_err("no mem for dma_pipes: kzalloc fail\n");
rc = -ENOMEM;
goto dma_alloc_fail;
goto parse_fail;
}
}
@ -2482,7 +2482,7 @@ static int mdss_mdp_parse_dt_pipe(struct platform_device *pdev)
if (!mdata->cursor_pipes) {
pr_err("no mem for cursor_pipes: kzalloc fail\n");
rc = -ENOMEM;
goto cursor_alloc_fail;
goto parse_fail;
}
rc = mdss_mdp_parse_dt_handler(pdev,
"qcom,mdss-pipe-cursor-off", offsets,
@ -2513,18 +2513,8 @@ static int mdss_mdp_parse_dt_pipe(struct platform_device *pdev)
pr_info("dedicated vp cursors detected, num=%d\n",
mdata->ncursor_pipes);
}
goto parse_done;
parse_fail:
kfree(mdata->cursor_pipes);
cursor_alloc_fail:
kfree(mdata->dma_pipes);
dma_alloc_fail:
kfree(mdata->rgb_pipes);
rgb_alloc_fail:
kfree(mdata->vig_pipes);
parse_done:
vig_alloc_fail:
kfree(xin_id);
xin_alloc_fail:
kfree(ftch_id);