On Wed, Apr 15, 2020 at 7:19 PM Andrzej Pietrasiewicz <andrzej.p@xxxxxxxxxxxxx> wrote: > > drm_gem_fb_init() is passed the fb and never allocates it, so it should be > not the one freeing it. As it is now the second call to kfree() is possible > with the same fb. Coverity reported the following: > > *** CID 1492613: Memory - corruptions (USE_AFTER_FREE) > /drivers/gpu/drm/drm_gem_framebuffer_helper.c: 230 in drm_gem_fb_create_with_funcs() > 224 fb = kzalloc(sizeof(*fb), GFP_KERNEL); > 225 if (!fb) > 226 return ERR_PTR(-ENOMEM); > 227 > 228 ret = drm_gem_fb_init_with_funcs(dev, fb, file, mode_cmd, funcs); > 229 if (ret) { > vvv CID 1492613: Memory - corruptions (USE_AFTER_FREE) > vvv Calling "kfree" frees pointer "fb" which has already been freed. [Note: The source code implementation of the function has been overridden by a user model.] > 230 kfree(fb); > 231 return ERR_PTR(ret); > 232 } > 233 > 234 return fb; > 235 } > > drm_gem_fb_init_with_funcs() calls drm_gem_fb_init() > drm_gem_fb_init() calls kfree(fb) > > Reported-by: coverity-bot <keescook+coverity-bot@xxxxxxxxxxxx> > Addresses-Coverity-ID: 1492613 ("Memory - corruptions") > Fixes: f2b816d78a94 ("drm/core: Allow drivers allocate a subclass of struct drm_framebuffer") > Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@xxxxxxxxxxxxx> Reviewed-by: Daniel Vetter <daniel.vetter@xxxxxxxx> > --- > drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +--- > 1 file changed, 1 insertion(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/drm_gem_framebuffer_helper.c b/drivers/gpu/drm/drm_gem_framebuffer_helper.c > index cac15294aef6..ccc2c71fa491 100644 > --- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c > +++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c > @@ -76,10 +76,8 @@ drm_gem_fb_init(struct drm_device *dev, > fb->obj[i] = obj[i]; > > ret = drm_framebuffer_init(dev, fb, funcs); > - if (ret) { > + if (ret) > drm_err(dev, "Failed to init framebuffer: %d\n", ret); > - kfree(fb); > - } > > return ret; > } > -- > 2.17.1 > -- Daniel Vetter Software Engineer, Intel Corporation +41 (0) 79 365 57 48 - http://blog.ffwll.ch