| Message ID | 20180926100559.30745-1-tomi.valkeinen@ti.com |
|---|---|
| State | Accepted |
| Commit | 2e65c7a6a15f006bf720f555ad1b63c6aadc5c9f |
| Headers | show |
| Series | drm/omap: fix use of freed memory | expand |
Hi Tomi, Thank you for the patch. On Wednesday, 26 September 2018 13:05:59 EEST Tomi Valkeinen wrote: > omap_connector_destroy() does: > > kfree(omap_connector); > omapdss_device_put(omap_connector->output); > omapdss_device_put(omap_connector->display); > > Fix this by moving the kfree after the omapdss_device_puts. > > This bug was introduced in 949ea2ef3fed4e1d0f9b80ec21ed81a9833ac248 > > Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Sorry for introducing the bug in the first place. > --- > drivers/gpu/drm/omapdrm/omap_connector.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/omapdrm/omap_connector.c > b/drivers/gpu/drm/omapdrm/omap_connector.c index 98f5ca29444a..b81302c4bf9e > 100644 > --- a/drivers/gpu/drm/omapdrm/omap_connector.c > +++ b/drivers/gpu/drm/omapdrm/omap_connector.c > @@ -164,10 +164,11 @@ static void omap_connector_destroy(struct > drm_connector *connector) > > drm_connector_unregister(connector); > drm_connector_cleanup(connector); > - kfree(omap_connector); > > omapdss_device_put(omap_connector->output); > omapdss_device_put(omap_connector->display); > + > + kfree(omap_connector); > } > > #define MAX_EDID 512
diff --git a/drivers/gpu/drm/omapdrm/omap_connector.c b/drivers/gpu/drm/omapdrm/omap_connector.c index 98f5ca29444a..b81302c4bf9e 100644 --- a/drivers/gpu/drm/omapdrm/omap_connector.c +++ b/drivers/gpu/drm/omapdrm/omap_connector.c @@ -164,10 +164,11 @@ static void omap_connector_destroy(struct drm_connector *connector) drm_connector_unregister(connector); drm_connector_cleanup(connector); - kfree(omap_connector); omapdss_device_put(omap_connector->output); omapdss_device_put(omap_connector->display); + + kfree(omap_connector); } #define MAX_EDID 512
omap_connector_destroy() does: kfree(omap_connector); omapdss_device_put(omap_connector->output); omapdss_device_put(omap_connector->display); Fix this by moving the kfree after the omapdss_device_puts. This bug was introduced in 949ea2ef3fed4e1d0f9b80ec21ed81a9833ac248 Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> --- drivers/gpu/drm/omapdrm/omap_connector.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)