diff mbox

drm/bridge: adv7511: Fix a use after free

Message ID 20171017204343.zctliubjkq7imudi@mwanda (mailing list archive)
State New, archived
Headers show

Commit Message

Dan Carpenter Oct. 17, 2017, 8:43 p.m. UTC 
We free "edid", then use it again on the next line.

Fixes: 3b1b975003e4 ("drm: adv7511/33: add HDMI CEC support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Comments

Archit Taneja Oct. 18, 2017, 4:13 a.m. UTC | #1 
On 10/18/2017 02:13 AM, Dan Carpenter wrote:
> We free "edid", then use it again on the next line.
> 
> Fixes: 3b1b975003e4 ("drm: adv7511/33: add HDMI CEC support")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Thanks for the fix. I've queued this to drm-misc-next.

Archit

> 
> diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
> index 31ca883bda83..0e14f1572d05 100644
> --- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
> +++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
> @@ -607,10 +607,10 @@ static int adv7511_get_modes(struct adv7511 *adv7511,
>   	adv7511_set_config_csc(adv7511, connector, adv7511->rgb,
>   			       drm_detect_hdmi_monitor(edid));
>   
> -	kfree(edid);
> -
>   	cec_s_phys_addr_from_edid(adv7511->cec_adap, edid);
>   
> +	kfree(edid);
> +
>   	return count;
>   }
>   
>
diff mbox

Patch

diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
index 31ca883bda83..0e14f1572d05 100644
--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
@@ -607,10 +607,10 @@  static int adv7511_get_modes(struct adv7511 *adv7511,
 	adv7511_set_config_csc(adv7511, connector, adv7511->rgb,
 			       drm_detect_hdmi_monitor(edid));
 
-	kfree(edid);
-
 	cec_s_phys_addr_from_edid(adv7511->cec_adap, edid);
 
+	kfree(edid);
+
 	return count;
 }