Hello! This is an experimental semi-automated report about issues detected by Coverity from a scan of next-20200415 as part of the linux-next scan project: https://scan.coverity.com/projects/linux-next-weekly-scan You're getting this email because you were associated with the identified lines of code (noted below) that were touched by commits: Wed Mar 11 15:55:36 2020 +0100 f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer") Coverity reported the following: *** CID 1492613: Memory - corruptions (USE_AFTER_FREE) /drivers/gpu/drm/drm_gem_framebuffer_helper.c: 230 in drm_gem_fb_create_with_funcs() 224 fb = kzalloc(sizeof(*fb), GFP_KERNEL); 225 if (!fb) 226 return ERR_PTR(-ENOMEM); 227 228 ret = drm_gem_fb_init_with_funcs(dev, fb, file, mode_cmd, funcs); 229 if (ret) { vvv CID 1492613: Memory - corruptions (USE_AFTER_FREE) vvv Calling "kfree" frees pointer "fb" which has already been freed. [Note: The source code implementation of the function has been overridden by a user model.] 230 kfree(fb); 231 return ERR_PTR(ret); 232 } 233 234 return fb; 235 } If this is a false positive, please let us know so we can mark it as such, or teach the Coverity rules to be smarter. If not, please make sure fixes get into linux-next. :) For patches fixing this, please include these lines (but double-check the "Fixes" first): Edit by human, double checking context: drm_gem_fb_init_with_funcs() calls drm_gem_fb_init() drm_gem_fb_init() calls kfree(fb) Reported-by: coverity-bot <keescook+coverity-bot@xxxxxxxxxxxx> Addresses-Coverity-ID: 1492613 ("Memory - corruptions") Fixes: f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer") Thanks for your attention! -- Coverity-bot
