dma-buf: free dmabuf->name in dma_buf_release()
commit5.4-rM2-2.2.x-imx-squashedd1f3722643
upstream. dma-buf name can be set via DMA_BUF_SET_NAME ioctl, but once set it never gets freed. Free it in dma_buf_release(). Fixes:bb2bb90304
("dma-buf: add DMA_BUF_SET_NAME ioctls") Reported-by: syzbot+b2098bc44728a4efb3e9@syzkaller.appspotmail.com Cc: Greg Hackmann <ghackmann@google.com> Cc: Chenbo Feng <fengc@google.com> Cc: Sumit Semwal <sumit.semwal@linaro.org> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Acked-by: Chenbo Feng <fengc@google.com> Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20191227063204.5813-1-xiyou.wangcong@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
709c6990ae
commit
08d67499d2
|
@ -108,6 +108,7 @@ static int dma_buf_release(struct inode *inode, struct file *file)
|
|||
dma_resv_fini(dmabuf->resv);
|
||||
|
||||
module_put(dmabuf->owner);
|
||||
kfree(dmabuf->name);
|
||||
kfree(dmabuf);
|
||||
return 0;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue