drm/msm: don't deref error pointer in the msm_fbdev_create error path
Currently the error pointer returned by msm_alloc_stolen_fb gets passed to drm_framebuffer_remove. The latter handles only NULL pointers, thus a nasty crash will occur. Drop the unnecessary fail label and the associated checks - both err and fb will be set at this stage. Cc: Rob Clark <robdclark@gmail.com> Cc: linux-arm-msm@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: freedreno@lists.freedesktop.org Signed-off-by: Emil Velikov <emil.velikov@collabora.com> Signed-off-by: Rob Clark <robdclark@gmail.com>
This commit is contained in:
parent
a4af89286f
commit
789d4c300e
|
@ -92,8 +92,7 @@ static int msm_fbdev_create(struct drm_fb_helper *helper,
|
|||
|
||||
if (IS_ERR(fb)) {
|
||||
dev_err(dev->dev, "failed to allocate fb\n");
|
||||
ret = PTR_ERR(fb);
|
||||
goto fail;
|
||||
return PTR_ERR(fb);
|
||||
}
|
||||
|
||||
bo = msm_framebuffer_bo(fb, 0);
|
||||
|
@ -151,13 +150,7 @@ static int msm_fbdev_create(struct drm_fb_helper *helper,
|
|||
|
||||
fail_unlock:
|
||||
mutex_unlock(&dev->struct_mutex);
|
||||
fail:
|
||||
|
||||
if (ret) {
|
||||
if (fb)
|
||||
drm_framebuffer_remove(fb);
|
||||
}
|
||||
|
||||
drm_framebuffer_remove(fb);
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue