Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

drivers/gpu/drm/radeon/radeon_cs.c: eliminate possible double free

Browse source 
The function radeon_cs_parser_init is only called from two places, in
drivers/gpu/drm/radeon/radeon_cs.c and drivers/gpu/drm/radeon/r600_cs.c.
In each case, if the call fails another function is called that frees all
of the kdata and dpage information in the chunks array.  So this
information should not be freed in radeon_cs_parser_init as well.

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This commit is contained in:
Julia Lawall 2012-03-17 18:03:29 +01:00 committed by Dave Airlie
parent abc8113fe5
commit f48bb04a56
1 changed files with 2 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
drivers/gpu/drm/radeon/radeon_cs.c
View file

@ -243,20 +243,11 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
if ((p->cs_flags & RADEON_CS_USE_VM) &&
!p->rdev->vm_manager.enabled) {
DRM_ERROR("VM not active on asic!\n");
if (p->chunk_relocs_idx != -1)
kfree(p->chunks[p->chunk_relocs_idx].kdata);
if (p->chunk_flags_idx != -1)
kfree(p->chunks[p->chunk_flags_idx].kdata);
return -EINVAL;
}
if (radeon_cs_get_ring(p, ring, priority)) {
if (p->chunk_relocs_idx != -1)
kfree(p->chunks[p->chunk_relocs_idx].kdata);
if (p->chunk_flags_idx != -1)
kfree(p->chunks[p->chunk_flags_idx].kdata);
if (radeon_cs_get_ring(p, ring, priority))
return -EINVAL;
}
/* deal with non-vm */
@ -271,11 +262,8 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
p->chunks[p->chunk_ib_idx].kpage[0] = kmalloc(PAGE_SIZE, GFP_KERNEL);
p->chunks[p->chunk_ib_idx].kpage[1] = kmalloc(PAGE_SIZE, GFP_KERNEL);
if (p->chunks[p->chunk_ib_idx].kpage[0] == NULL ||
p->chunks[p->chunk_ib_idx].kpage[1] == NULL) {
kfree(p->chunks[p->chunk_ib_idx].kpage[0]);
kfree(p->chunks[p->chunk_ib_idx].kpage[1]);
p->chunks[p->chunk_ib_idx].kpage[1] == NULL)
return -ENOMEM;
}
p->chunks[p->chunk_ib_idx].kpage_idx[0] = -1;
p->chunks[p->chunk_ib_idx].kpage_idx[1] = -1;
p->chunks[p->chunk_ib_idx].last_copied_page = -1;