[PATCH][next] drm: simpledrm: Fix use after free issues

[PATCH][next] drm: simpledrm: Fix use after free issues

[Colin King]

From: Colin Ian King <colin.king@canonical.com>

There are two occurrances where objects are being free'd via
a put call and yet they are being referenced after this. Fix these
by adding in the missing continue statement so that the put on the
end of the loop is skipped over.

Addresses-Coverity: ("Use after free")
Fixes: 11e8f5fd223b ("drm: Add simpledrm driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/gpu/drm/tiny/simpledrm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/tiny/simpledrm.c b/drivers/gpu/drm/tiny/simpledrm.c
index 2bdb477d9326..eae748394b00 100644
--- a/drivers/gpu/drm/tiny/simpledrm.c
+++ b/drivers/gpu/drm/tiny/simpledrm.c
@@ -298,6 +298,7 @@ static int simpledrm_device_init_clocks(struct simpledrm_device *sdev)
 			drm_err(dev, "failed to enable clock %u: %d\n",
 				i, ret);
 			clk_put(clock);
+			continue;
 		}
 		sdev->clks[i] = clock;
 	}
@@ -415,6 +416,7 @@ static int simpledrm_device_init_regulators(struct simpledrm_device *sdev)
 			drm_err(dev, "failed to enable regulator %u: %d\n",
 				i, ret);
 			regulator_put(regulator);
+			continue;
 		}
 
 		sdev->regulators[i++] = regulator;
-- 
2.30.2

Re: [PATCH][next] drm: simpledrm: Fix use after free issues

[Thomas Zimmermann]

[-- Attachment #1.1: Type: text/plain, Size: 1616 bytes --]

Hi

Am 12.05.21 um 22:30 schrieb Colin King:
> From: Colin Ian King <colin.king@canonical.com>
> 
> There are two occurrances where objects are being free'd via
> a put call and yet they are being referenced after this. Fix these
> by adding in the missing continue statement so that the put on the
> end of the loop is skipped over.
> 
> Addresses-Coverity: ("Use after free")
> Fixes: 11e8f5fd223b ("drm: Add simpledrm driver")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>

Queued up for drm-misc-next. Thanks!

Best regards
Thomas

> ---
>   drivers/gpu/drm/tiny/simpledrm.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/gpu/drm/tiny/simpledrm.c b/drivers/gpu/drm/tiny/simpledrm.c
> index 2bdb477d9326..eae748394b00 100644
> --- a/drivers/gpu/drm/tiny/simpledrm.c
> +++ b/drivers/gpu/drm/tiny/simpledrm.c
> @@ -298,6 +298,7 @@ static int simpledrm_device_init_clocks(struct simpledrm_device *sdev)
>   			drm_err(dev, "failed to enable clock %u: %d\n",
>   				i, ret);
>   			clk_put(clock);
> +			continue;
>   		}
>   		sdev->clks[i] = clock;
>   	}
> @@ -415,6 +416,7 @@ static int simpledrm_device_init_regulators(struct simpledrm_device *sdev)
>   			drm_err(dev, "failed to enable regulator %u: %d\n",
>   				i, ret);
>   			regulator_put(regulator);
> +			continue;
>   		}
>   
>   		sdev->regulators[i++] = regulator;
> 

-- 
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg)
Geschäftsführer: Felix Imendörffer


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]