From patchwork Tue May 5 13:47:57 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephane Viau X-Patchwork-Id: 6338151 Return-Path: X-Original-To: patchwork-linux-arm-msm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 2CC689F1C2 for ; Tue, 5 May 2015 13:48:44 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 2BE4B202F8 for ; Tue, 5 May 2015 13:48:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 359D320303 for ; Tue, 5 May 2015 13:48:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2992577AbbEENsc (ORCPT ); Tue, 5 May 2015 09:48:32 -0400 Received: from smtp.codeaurora.org ([198.145.29.96]:49934 "EHLO smtp.codeaurora.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2992570AbbEENs1 (ORCPT ); Tue, 5 May 2015 09:48:27 -0400 Received: from smtp.codeaurora.org (localhost [127.0.0.1]) by smtp.codeaurora.org (Postfix) with ESMTP id 534C0140E24; Tue, 5 May 2015 13:48:25 +0000 (UTC) Received: by smtp.codeaurora.org (Postfix, from userid 486) id 33A63140E26; Tue, 5 May 2015 13:48:25 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from yyzubuntu31.qualcomm.com (rrcs-67-52-130-30.west.biz.rr.com [67.52.130.30]) (using TLSv1.1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: sviau@smtp.codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id 6E3E9140E1E; Tue, 5 May 2015 13:48:23 +0000 (UTC) From: Stephane Viau To: dri-devel@lists.freedesktop.org Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, robdclark@gmail.com, Stephane Viau Subject: [PATCH] drm/msm: fix unbalanced DRM framebuffer init/destroy Date: Tue, 5 May 2015 09:47:57 -0400 Message-Id: <1430833677-16010-1-git-send-email-sviau@codeaurora.org> X-Mailer: git-send-email 1.8.2.1 X-Virus-Scanned: ClamAV using ClamSMTP Sender: linux-arm-msm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When msm_framebuffer_init() fails before calling drm_framebuffer_init(), drm_framebuffer_cleanup() [called in msm_framebuffer_destroy()] is still being called even though drm_framebuffer_init() was not called for that buffer. Thus a NULL pointer derefencing: [ 247.529691] Unable to handle kernel NULL pointer dereference at virtual address 0000027c ... [ 247.563996] PC is at __mutex_lock_slowpath+0x94/0x3a8 ... [ 247.823025] [] (__mutex_lock_slowpath) from [] (mutex_lock+0x20/0x3c) [ 247.831186] [] (mutex_lock) from [] (drm_framebuffer_cleanup+0x18/0x38) [ 247.839520] [] (drm_framebuffer_cleanup) from [] (msm_framebuffer_destroy+0x48/0x100) [ 247.849066] [] (msm_framebuffer_destroy) from [] (msm_framebuffer_init+0x1e8/0x228) [ 247.858439] [] (msm_framebuffer_init) from [] (msm_framebuffer_create+0x70/0x134) [ 247.867642] [] (msm_framebuffer_create) from [] (internal_framebuffer_create+0x67c/0x7b4) [ 247.877537] [] (internal_framebuffer_create) from [] (drm_mode_addfb2+0x20/0x98) [ 247.886650] [] (drm_mode_addfb2) from [] (drm_ioctl+0x240/0x420) [ 247.894378] [] (drm_ioctl) from [] (do_vfs_ioctl+0x4e4/0x5a4) ... Signed-off-by: Stephane Viau --- drivers/gpu/drm/msm/msm_fb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/gpu/drm/msm/msm_fb.c b/drivers/gpu/drm/msm/msm_fb.c index 6b573e6..c0f09d3 100644 --- a/drivers/gpu/drm/msm/msm_fb.c +++ b/drivers/gpu/drm/msm/msm_fb.c @@ -239,8 +239,7 @@ struct drm_framebuffer *msm_framebuffer_init(struct drm_device *dev, return fb; fail: - if (fb) - msm_framebuffer_destroy(fb); + kfree(msm_fb); return ERR_PTR(ret); }