[PATCH -next] drm/tegra: sor: Fix invalid kfree of devm_kzalloc allocated data

Alexandre Courbot gnurou at gmail.com
Thu Jul 7 04:24:04 UTC 2016


On Mon, Jul 4, 2016 at 4:19 PM,  <weiyj_lk at 163.com> wrote:
> From: Wei Yongjun <yongjun_wei at trendmicro.com.cn>
>
> data allocated with devm_kzalloc should not be freed using kfree,
> because doing so causes a dangling pointer, and a subsequent
> double free, use devm_kfree instead.
>
> Signed-off-by: Wei Yongjun <yongjun_wei at trendmicro.com.cn>
> ---
>  drivers/gpu/drm/tegra/sor.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
> index 8425eda..af98587 100644
> --- a/drivers/gpu/drm/tegra/sor.c
> +++ b/drivers/gpu/drm/tegra/sor.c
> @@ -363,7 +363,7 @@ static struct clk *tegra_clk_sor_brick_register(struct tegra_sor *sor,
>
>         clk = devm_clk_register(sor->dev, &brick->hw);
>         if (IS_ERR(clk))
> -               kfree(brick);
> +               devm_kfree(sor->dev, brick);
>
>         return clk;
>  }

Dan sent another fix for this:

https://lkml.org/lkml/2016/7/4/83

I tend to prefer his solution since it has a negative line count and
also doesn't do the (unneeded) explicit devm_kfree().

Thanks though!
Alex.


More information about the dri-devel mailing list