diff mbox series

[resend] drm/v3d: Fix double free in v3d_submit_cl_ioctl()

Message ID 20201026094905.GA1634423@mwanda (mailing list archive)
State New, archived
Headers show
Series [resend] drm/v3d: Fix double free in v3d_submit_cl_ioctl() | expand

Commit Message

Dan Carpenter Oct. 26, 2020, 9:49 a.m. UTC
Originally this error path used to leak "bin" but then we accidentally
applied two separate commits to fix it and ended up with a double free.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
Resending a year later because it was confusing at the time who should
apply this and it fell through the cracks.  For some reason the kbuild
bot flagged it as a new warning so it showed up on my radar again.

 drivers/gpu/drm/v3d/v3d_gem.c | 1 -
 1 file changed, 1 deletion(-)

Comments

Maxime Ripard Oct. 26, 2020, 10:23 a.m. UTC | #1
On Mon, Oct 26, 2020 at 12:49:05PM +0300, Dan Carpenter wrote:
> Originally this error path used to leak "bin" but then we accidentally
> applied two separate commits to fix it and ended up with a double free.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> Resending a year later because it was confusing at the time who should
> apply this and it fell through the cracks.  For some reason the kbuild
> bot flagged it as a new warning so it showed up on my radar again.

Applied, thanks!
Maxime
diff mbox series

Patch

diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 549dde83408b..37515e47b47e 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -568,7 +568,6 @@  v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 		ret = v3d_job_init(v3d, file_priv, &bin->base,
 				   v3d_job_free, args->in_sync_bcl);
 		if (ret) {
-			kfree(bin);
 			v3d_job_put(&render->base);
 			kfree(bin);
 			return ret;