redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity
alistair23-linux/drivers/gpu/drm/vmwgfx
History
Dan Carpenter 08b0c89160 drm/vmwgfx: Fix double free in vmw_recv_msg() 
We recently added a kfree() after the end of the loop:

	if (retries == RETRIES) {
		kfree(reply);
		return -EINVAL;
	}

There are two problems.  First the test is wrong and because retries
equals RETRIES if we succeed on the last iteration through the loop.
Second if we fail on the last iteration through the loop then the kfree
is a double free.

When you're reading this code, please note the break statement at the
end of the while loop.  This patch changes the loop so that if it's not
successful then "reply" is NULL and we can test for that afterward.

Cc: <stable@vger.kernel.org>
Fixes: 6b7c3b86f0 ("drm/vmwgfx: fix memory leak when too many retries have occurred")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
 		2019-09-05 14:44:28 +02:00
..
device_include Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
Kconfig Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
Makefile Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
ttm_lock.c Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
ttm_lock.h Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
ttm_object.c drm/vmwgfx: Fix user space handle equal to zero 2019-05-21 10:23:09 +02:00
ttm_object.h drm/vmwgfx: Look up objects without taking a reference 2018-09-27 16:14:48 +02:00
vmwgfx_binding.c drm/vmwgfx: Use preprocessor macro for FIFO allocation 2019-04-08 10:29:05 -07:00
vmwgfx_binding.h drm/vmwgfx: Be more restrictive when dirtying resources 2019-04-08 10:29:04 -07:00
vmwgfx_blit.c drm/vmwgfx: add SPDX idenitifier and clarify license 2018-06-29 15:28:48 -05:00
vmwgfx_bo.c Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
vmwgfx_cmdbuf.c drm/vmwgfx: Use VMW_DEBUG_USER for device command buffer errors 2019-04-08 10:29:05 -07:00
vmwgfx_cmdbuf_res.c drm/vmwgfx: Don't refcount command-buffer managed resource lookups during command buffer validation 2018-09-28 08:57:08 +02:00
vmwgfx_context.c Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
vmwgfx_cotable.c Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
vmwgfx_drv.c Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
vmwgfx_drv.h Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
vmwgfx_execbuf.c Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
vmwgfx_fb.c drm/vmwgfx: Remove set but not used variable 'fb_offset, fb_depth' 2019-04-08 10:29:05 -07:00
vmwgfx_fence.c drm/vmwgfx: Remove set but not used variable 'file_priv' 2018-12-05 10:09:27 +01:00
vmwgfx_fence.h drm/vmwgfx: add SPDX idenitifier and clarify license 2018-06-29 15:28:48 -05:00
vmwgfx_fifo.c drm/vmwgfx: Use preprocessor macro for FIFO allocation 2019-04-08 10:29:05 -07:00
vmwgfx_gmr.c drm/vmwgfx: Use preprocessor macro for FIFO allocation 2019-04-08 10:29:05 -07:00
vmwgfx_gmrid_manager.c drm/vmwgfx: Return 0 when gmrid::get_node runs out of ID's 2019-03-20 07:53:29 +01:00
vmwgfx_ioctl.c drm/vmwgfx: Add a new define for vmwgfx user-space debugging 2019-04-08 10:29:04 -07:00
vmwgfx_irq.c drm/vmwgfx: add SPDX idenitifier and clarify license 2018-06-29 15:28:48 -05:00
vmwgfx_kms.c Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
vmwgfx_kms.h drm: Split out drm_probe_helper.h 2019-01-24 13:20:42 +01:00
vmwgfx_ldu.c drm/vmwgfx: Use preprocessor macro for FIFO allocation 2019-04-08 10:29:05 -07:00
vmwgfx_marker.c drm/vmwgfx: add SPDX idenitifier and clarify license 2018-06-29 15:28:48 -05:00
vmwgfx_mob.c drm/vmwgfx: Use preprocessor macro for FIFO allocation 2019-04-08 10:29:05 -07:00
vmwgfx_msg.c drm/vmwgfx: Fix double free in vmw_recv_msg() 2019-09-05 14:44:28 +02:00
vmwgfx_msg.h drm/vmwgfx: add SPDX idenitifier and clarify license 2018-06-29 15:28:48 -05:00
vmwgfx_overlay.c drm/vmwgfx: Use preprocessor macro for FIFO allocation 2019-04-08 10:29:05 -07:00
vmwgfx_prime.c drm/ttm, drm/vmwgfx: Move the lock- and object functionality to the vmwgfx driver 2018-09-27 15:19:20 +02:00
vmwgfx_reg.h drm/vmwgfx: add SPDX idenitifier and clarify license 2018-06-29 15:28:48 -05:00
vmwgfx_resource.c Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
vmwgfx_resource_priv.h Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
vmwgfx_scrn.c drm/vmwgfx: Use preprocessor macro for FIFO allocation 2019-04-08 10:29:05 -07:00
vmwgfx_shader.c Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
vmwgfx_simple_resource.c drm/vmwgfx: Add a new define for vmwgfx user-space debugging 2019-04-08 10:29:04 -07:00
vmwgfx_so.c drm/vmwgfx: Use preprocessor macro for FIFO allocation 2019-04-08 10:29:05 -07:00
vmwgfx_so.h drm/vmwgfx: Be more restrictive when dirtying resources 2019-04-08 10:29:04 -07:00
vmwgfx_stdu.c drm/vmwgfx: Use preprocessor macro for FIFO allocation 2019-04-08 10:29:05 -07:00
vmwgfx_surface.c Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
vmwgfx_ttm_buffer.c drm/vmwgfx: Honor the sg list segment size limitation 2019-06-11 17:00:23 +02:00
vmwgfx_ttm_glue.c drm/ttm: Quick-test mmap offset in ttm_bo_mmap() 2019-03-19 15:03:53 -05:00
vmwgfx_va.c drm/vmwgfx: add SPDX idenitifier and clarify license 2018-06-29 15:28:48 -05:00
vmwgfx_validation.c Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00
vmwgfx_validation.h Revert "Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next" 2019-07-16 04:07:13 +10:00