* [PATCH][next] drm/dp_mst: fix multiple frees of tx->bytes
@ 2019-11-20 17:35 Colin King
2019-11-20 18:59 ` Lyude Paul
0 siblings, 1 reply; 4+ messages in thread
From: Colin King @ 2019-11-20 17:35 UTC (permalink / raw)
To: Maarten Lankhorst, Maxime Ripard, Sean Paul, David Airlie,
Daniel Vetter, Lyude Paul, dri-devel
Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
Currently tx->bytes is being freed r->num_transactions number of
times because tx is not being set correctly. Fix this by setting
tx to &r->transactions[i] so that the correct objects are being
freed on each loop iteration.
Addresses-Coverity: ("Double free")
Fixes: 2f015ec6eab6 ("drm/dp_mst: Add sideband down request tracing + selftests")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/gpu/drm/drm_dp_mst_topology.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index ae5809a1f19a..2754e7e075e7 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -517,8 +517,10 @@ drm_dp_decode_sideband_req(const struct drm_dp_sideband_msg_tx *raw,
}
if (failed) {
- for (i = 0; i < r->num_transactions; i++)
+ for (i = 0; i < r->num_transactions; i++) {
+ tx = &r->transactions[i];
kfree(tx->bytes);
+ }
return -ENOMEM;
}
--
2.24.0
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH][next] drm/dp_mst: fix multiple frees of tx->bytes
2019-11-20 17:35 [PATCH][next] drm/dp_mst: fix multiple frees of tx->bytes Colin King
@ 2019-11-20 18:59 ` Lyude Paul
2019-11-20 19:11 ` Colin Ian King
0 siblings, 1 reply; 4+ messages in thread
From: Lyude Paul @ 2019-11-20 18:59 UTC (permalink / raw)
To: Colin King, Maarten Lankhorst, Maxime Ripard, Sean Paul,
David Airlie, Daniel Vetter, dri-devel
Cc: kernel-janitors, linux-kernel
Heh, surprised I missed this one!
Reviewed-by: Lyude Paul <lyude@redhat.com>
Do you need me to push this to drm-misc, or do you have commit rights already?
On Wed, 2019-11-20 at 17:35 +0000, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> Currently tx->bytes is being freed r->num_transactions number of
> times because tx is not being set correctly. Fix this by setting
> tx to &r->transactions[i] so that the correct objects are being
> freed on each loop iteration.
>
> Addresses-Coverity: ("Double free")
> Fixes: 2f015ec6eab6 ("drm/dp_mst: Add sideband down request tracing +
> selftests")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> ---
> drivers/gpu/drm/drm_dp_mst_topology.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c
> b/drivers/gpu/drm/drm_dp_mst_topology.c
> index ae5809a1f19a..2754e7e075e7 100644
> --- a/drivers/gpu/drm/drm_dp_mst_topology.c
> +++ b/drivers/gpu/drm/drm_dp_mst_topology.c
> @@ -517,8 +517,10 @@ drm_dp_decode_sideband_req(const struct
> drm_dp_sideband_msg_tx *raw,
> }
>
> if (failed) {
> - for (i = 0; i < r->num_transactions; i++)
> + for (i = 0; i < r->num_transactions; i++) {
> + tx = &r->transactions[i];
> kfree(tx->bytes);
> + }
> return -ENOMEM;
> }
>
--
Cheers,
Lyude Paul
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH][next] drm/dp_mst: fix multiple frees of tx->bytes
2019-11-20 18:59 ` Lyude Paul
@ 2019-11-20 19:11 ` Colin Ian King
2019-11-20 19:18 ` Lyude Paul
0 siblings, 1 reply; 4+ messages in thread
From: Colin Ian King @ 2019-11-20 19:11 UTC (permalink / raw)
To: Lyude Paul, Maarten Lankhorst, Maxime Ripard, Sean Paul,
David Airlie, Daniel Vetter, dri-devel
Cc: kernel-janitors, linux-kernel
On 20/11/2019 18:59, Lyude Paul wrote:
> Heh, surprised I missed this one!
>
> Reviewed-by: Lyude Paul <lyude@redhat.com>
>
> Do you need me to push this to drm-misc, or do you have commit rights already
I have no commit rights.
>
> On Wed, 2019-11-20 at 17:35 +0000, Colin King wrote:
>> From: Colin Ian King <colin.king@canonical.com>
>>
>> Currently tx->bytes is being freed r->num_transactions number of
>> times because tx is not being set correctly. Fix this by setting
>> tx to &r->transactions[i] so that the correct objects are being
>> freed on each loop iteration.
>>
>> Addresses-Coverity: ("Double free")
>> Fixes: 2f015ec6eab6 ("drm/dp_mst: Add sideband down request tracing +
>> selftests")
>> Signed-off-by: Colin Ian King <colin.king@canonical.com>
>> ---
>> drivers/gpu/drm/drm_dp_mst_topology.c | 4 +++-
>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c
>> b/drivers/gpu/drm/drm_dp_mst_topology.c
>> index ae5809a1f19a..2754e7e075e7 100644
>> --- a/drivers/gpu/drm/drm_dp_mst_topology.c
>> +++ b/drivers/gpu/drm/drm_dp_mst_topology.c
>> @@ -517,8 +517,10 @@ drm_dp_decode_sideband_req(const struct
>> drm_dp_sideband_msg_tx *raw,
>> }
>>
>> if (failed) {
>> - for (i = 0; i < r->num_transactions; i++)
>> + for (i = 0; i < r->num_transactions; i++) {
>> + tx = &r->transactions[i];
>> kfree(tx->bytes);
>> + }
>> return -ENOMEM;
>> }
>>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH][next] drm/dp_mst: fix multiple frees of tx->bytes
2019-11-20 19:11 ` Colin Ian King
@ 2019-11-20 19:18 ` Lyude Paul
0 siblings, 0 replies; 4+ messages in thread
From: Lyude Paul @ 2019-11-20 19:18 UTC (permalink / raw)
To: Colin Ian King, Maarten Lankhorst, Maxime Ripard, Sean Paul,
David Airlie, Daniel Vetter, dri-devel
Cc: kernel-janitors, linux-kernel
On Wed, 2019-11-20 at 19:11 +0000, Colin Ian King wrote:
> On 20/11/2019 18:59, Lyude Paul wrote:
> > Heh, surprised I missed this one!
> >
> > Reviewed-by: Lyude Paul <lyude@redhat.com>
> >
> > Do you need me to push this to drm-misc, or do you have commit rights
> > already
>
> I have no commit rights.
Gotcha:
Enumerating objects: 11, done.
Counting objects: 100% (11/11), done.
Delta compression using up to 4 threads
Compressing objects: 100% (6/6), done.
Writing objects: 100% (6/6), 885 bytes | 442.00 KiB/s, done.
Total 6 (delta 5), reused 0 (delta 0)
To ssh://git.freedesktop.org/git/drm/drm-misc
8896e40c05cc..2c8bc91488fc drm-misc-next -> drm-misc-next
Pushing drm-misc-fixes to for-linux-next-fixes... Everything up-to-date
Done.
Pushing drm-misc-next-fixes to for-linux-next... Everything up-to-date
Done.
Updating rerere cache... Done.
Reloading nightly.conf... Done.
Fetching drm-amd... Done.
Fetching drm-intel... Done.
Fetching sound-upstream (local remote sound)... Done.
Fetching drm... Done.
Fetching drm-misc... Done.
Fetching linux-upstream (local remote origin)... Done.
Fetching drm-tip... Done.
Merging drm/drm-fixes... Reset. Done.
Merging drm-misc/drm-misc-fixes... Fast-forward. Done.
Merging drm-intel/drm-intel-fixes... Fast-forward. Done.
Merging drm-amd/drm-amd-fixes... Fast-forward. Done.
Merging drm/drm-next... Done.
Merging drm-misc/drm-misc-next-fixes... Done.
Merging drm-intel/drm-intel-next-fixes... Done.
Merging drm-amd/drm-amd-next-fixes... Fast-forward. Done.
Merging drm-misc/drm-misc-next... Done.
Merging drm-intel/drm-intel-next-queued... Done.
Merging drm-intel/drm-intel-next... Fast-forward. Done.
Merging drm-amd/drm-amd-next... Fast-forward. Done.
Merging sound-upstream/for-linus (local remote sound)... Fast-forward. Done.
Merging sound-upstream/for-next (local remote sound)... Done.
Merging drm-intel/topic/core-for-CI... Done.
Adding integration manifest drm-tip: 2019y-11m-20d-19h-16m-39s UTC... Done.
Pushing drm-tip... Done.
Finalizing rerere cache... Nothing changed. Pushing rerere cache... Done.
Thanks for the patch!
>
>
> > On Wed, 2019-11-20 at 17:35 +0000, Colin King wrote:
> > > From: Colin Ian King <colin.king@canonical.com>
> > >
> > > Currently tx->bytes is being freed r->num_transactions number of
> > > times because tx is not being set correctly. Fix this by setting
> > > tx to &r->transactions[i] so that the correct objects are being
> > > freed on each loop iteration.
> > >
> > > Addresses-Coverity: ("Double free")
> > > Fixes: 2f015ec6eab6 ("drm/dp_mst: Add sideband down request tracing +
> > > selftests")
> > > Signed-off-by: Colin Ian King <colin.king@canonical.com>
> > > ---
> > > drivers/gpu/drm/drm_dp_mst_topology.c | 4 +++-
> > > 1 file changed, 3 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c
> > > b/drivers/gpu/drm/drm_dp_mst_topology.c
> > > index ae5809a1f19a..2754e7e075e7 100644
> > > --- a/drivers/gpu/drm/drm_dp_mst_topology.c
> > > +++ b/drivers/gpu/drm/drm_dp_mst_topology.c
> > > @@ -517,8 +517,10 @@ drm_dp_decode_sideband_req(const struct
> > > drm_dp_sideband_msg_tx *raw,
> > > }
> > >
> > > if (failed) {
> > > - for (i = 0; i < r->num_transactions; i++)
> > > + for (i = 0; i < r->num_transactions; i++) {
> > > + tx = &r->transactions[i];
> > > kfree(tx->bytes);
> > > + }
> > > return -ENOMEM;
> > > }
> > >
--
Cheers,
Lyude Paul
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-11-20 19:18 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-20 17:35 [PATCH][next] drm/dp_mst: fix multiple frees of tx->bytes Colin King
2019-11-20 18:59 ` Lyude Paul
2019-11-20 19:11 ` Colin Ian King
2019-11-20 19:18 ` Lyude Paul
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®