From patchwork Tue May 5 13:47:57 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephane Viau X-Patchwork-Id: 6338141 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 11A8F9F1C2 for ; Tue, 5 May 2015 13:48:31 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 426D8202F2 for ; Tue, 5 May 2015 13:48:30 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 79BF2202BE for ; Tue, 5 May 2015 13:48:28 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id D41DC6E530; Tue, 5 May 2015 06:48:26 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from smtp.codeaurora.org (smtp.codeaurora.org [198.145.29.96]) by gabe.freedesktop.org (Postfix) with ESMTP id 8EA6A6E530 for ; Tue, 5 May 2015 06:48:25 -0700 (PDT) Received: from smtp.codeaurora.org (localhost [127.0.0.1]) by smtp.codeaurora.org (Postfix) with ESMTP id 534C0140E24; Tue, 5 May 2015 13:48:25 +0000 (UTC) Received: by smtp.codeaurora.org (Postfix, from userid 486) id 33A63140E26; Tue, 5 May 2015 13:48:25 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from yyzubuntu31.qualcomm.com (rrcs-67-52-130-30.west.biz.rr.com [67.52.130.30]) (using TLSv1.1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: sviau@smtp.codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id 6E3E9140E1E; Tue, 5 May 2015 13:48:23 +0000 (UTC) From: Stephane Viau To: dri-devel@lists.freedesktop.org Subject: [PATCH] drm/msm: fix unbalanced DRM framebuffer init/destroy Date: Tue, 5 May 2015 09:47:57 -0400 Message-Id: <1430833677-16010-1-git-send-email-sviau@codeaurora.org> X-Mailer: git-send-email 1.8.2.1 X-Virus-Scanned: ClamAV using ClamSMTP Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP When msm_framebuffer_init() fails before calling drm_framebuffer_init(), drm_framebuffer_cleanup() [called in msm_framebuffer_destroy()] is still being called even though drm_framebuffer_init() was not called for that buffer. Thus a NULL pointer derefencing: [ 247.529691] Unable to handle kernel NULL pointer dereference at virtual address 0000027c ... [ 247.563996] PC is at __mutex_lock_slowpath+0x94/0x3a8 ... [ 247.823025] [] (__mutex_lock_slowpath) from [] (mutex_lock+0x20/0x3c) [ 247.831186] [] (mutex_lock) from [] (drm_framebuffer_cleanup+0x18/0x38) [ 247.839520] [] (drm_framebuffer_cleanup) from [] (msm_framebuffer_destroy+0x48/0x100) [ 247.849066] [] (msm_framebuffer_destroy) from [] (msm_framebuffer_init+0x1e8/0x228) [ 247.858439] [] (msm_framebuffer_init) from [] (msm_framebuffer_create+0x70/0x134) [ 247.867642] [] (msm_framebuffer_create) from [] (internal_framebuffer_create+0x67c/0x7b4) [ 247.877537] [] (internal_framebuffer_create) from [] (drm_mode_addfb2+0x20/0x98) [ 247.886650] [] (drm_mode_addfb2) from [] (drm_ioctl+0x240/0x420) [ 247.894378] [] (drm_ioctl) from [] (do_vfs_ioctl+0x4e4/0x5a4) ... Signed-off-by: Stephane Viau --- drivers/gpu/drm/msm/msm_fb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/gpu/drm/msm/msm_fb.c b/drivers/gpu/drm/msm/msm_fb.c index 6b573e6..c0f09d3 100644 --- a/drivers/gpu/drm/msm/msm_fb.c +++ b/drivers/gpu/drm/msm/msm_fb.c @@ -239,8 +239,7 @@ struct drm_framebuffer *msm_framebuffer_init(struct drm_device *dev, return fb; fail: - if (fb) - msm_framebuffer_destroy(fb); + kfree(msm_fb); return ERR_PTR(ret); }