hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

drm: use after free in drm_queue_vblank_event() 

The "e" pointer is either NULL or freed when we call
drm_vblank_put(dev, e->pipe) on the error path.  Just pass the "pipe"
variable directly instead.

I changed another caller to use "pipe" as well for consistency.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This commit is contained in:
Dan Carpenter 2010-12-09 08:35:40 +03:00 committed by Dave Airlie
parent e76116ca96
commit 6f331623b9
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/gpu/drm/drm_irq.c
View File

@ -628,7 +628,7 @@ static int drm_queue_vblank_event(struct drm_device *dev, int pipe,
if ((seq - vblwait->request.sequence) <= (1 << 23)) { if ((seq - vblwait->request.sequence) <= (1 << 23)) {
e->event.tv_sec = now.tv_sec; e->event.tv_sec = now.tv_sec;
e->event.tv_usec = now.tv_usec; e->event.tv_usec = now.tv_usec;
drm_vblank_put(dev, e->pipe); drm_vblank_put(dev, pipe);
list_add_tail(&e->base.link, &e->base.file_priv->event_list); list_add_tail(&e->base.link, &e->base.file_priv->event_list);
wake_up_interruptible(&e->base.file_priv->event_wait); wake_up_interruptible(&e->base.file_priv->event_wait);
trace_drm_vblank_event_delivered(current->pid, pipe, trace_drm_vblank_event_delivered(current->pid, pipe,
@ -645,7 +645,7 @@ err_unlock:
spin_unlock_irqrestore(&dev->event_lock, flags); spin_unlock_irqrestore(&dev->event_lock, flags);
kfree(e); kfree(e);
err_put: err_put:
drm_vblank_put(dev, e->pipe); drm_vblank_put(dev, pipe);
return ret; return ret;
} }