| Message ID | 20210512203051.299026-1-colin.king@canonical.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [next] drm: simpledrm: Fix use after free issues | expand |
Hi Am 12.05.21 um 22:30 schrieb Colin King: > From: Colin Ian King <colin.king@canonical.com> > > There are two occurrances where objects are being free'd via > a put call and yet they are being referenced after this. Fix these > by adding in the missing continue statement so that the put on the > end of the loop is skipped over. > > Addresses-Coverity: ("Use after free") > Fixes: 11e8f5fd223b ("drm: Add simpledrm driver") > Signed-off-by: Colin Ian King <colin.king@canonical.com> Queued up for drm-misc-next. Thanks! Best regards Thomas > --- > drivers/gpu/drm/tiny/simpledrm.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/gpu/drm/tiny/simpledrm.c b/drivers/gpu/drm/tiny/simpledrm.c > index 2bdb477d9326..eae748394b00 100644 > --- a/drivers/gpu/drm/tiny/simpledrm.c > +++ b/drivers/gpu/drm/tiny/simpledrm.c > @@ -298,6 +298,7 @@ static int simpledrm_device_init_clocks(struct simpledrm_device *sdev) > drm_err(dev, "failed to enable clock %u: %d\n", > i, ret); > clk_put(clock); > + continue; > } > sdev->clks[i] = clock; > } > @@ -415,6 +416,7 @@ static int simpledrm_device_init_regulators(struct simpledrm_device *sdev) > drm_err(dev, "failed to enable regulator %u: %d\n", > i, ret); > regulator_put(regulator); > + continue; > } > > sdev->regulators[i++] = regulator; >
diff --git a/drivers/gpu/drm/tiny/simpledrm.c b/drivers/gpu/drm/tiny/simpledrm.c index 2bdb477d9326..eae748394b00 100644 --- a/drivers/gpu/drm/tiny/simpledrm.c +++ b/drivers/gpu/drm/tiny/simpledrm.c @@ -298,6 +298,7 @@ static int simpledrm_device_init_clocks(struct simpledrm_device *sdev) drm_err(dev, "failed to enable clock %u: %d\n", i, ret); clk_put(clock); + continue; } sdev->clks[i] = clock; } @@ -415,6 +416,7 @@ static int simpledrm_device_init_regulators(struct simpledrm_device *sdev) drm_err(dev, "failed to enable regulator %u: %d\n", i, ret); regulator_put(regulator); + continue; } sdev->regulators[i++] = regulator;