* [PATCH] drm/gem: Correct error condition in drm_gem_objects_lookup
@ 2025-11-24 11:20 Steven Price
2025-11-24 11:31 ` Tvrtko Ursulin
2025-11-26 11:21 ` Steven Price
0 siblings, 2 replies; 3+ messages in thread
From: Steven Price @ 2025-11-24 11:20 UTC (permalink / raw)
To: David Airlie, Maarten Lankhorst, Maxime Ripard, Simona Vetter,
Thomas Zimmermann
Cc: Steven Price, dri-devel, linux-kernel, André Almeida,
Tvrtko Ursulin
When vmemdup_array_user() fails, 'handles' is set to a negative error
code and no memory is allocated. So the call to kvfree() should not
happen. Instead just return early with the error code.
Fixes: cb77b79abf5f ("drm/gem: Use vmemdup_array_user in drm_gem_objects_lookup")
Signed-off-by: Steven Price <steven.price@arm.com>
---
drivers/gpu/drm/drm_gem.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 68168d58a7c8..efc79bbf3c73 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -798,13 +798,10 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles,
*objs_out = objs;
handles = vmemdup_array_user(bo_handles, count, sizeof(u32));
- if (IS_ERR(handles)) {
- ret = PTR_ERR(handles);
- goto out;
- }
+ if (IS_ERR(handles))
+ return PTR_ERR(handles);
ret = objects_lookup(filp, handles, count, objs);
-out:
kvfree(handles);
return ret;
--
2.43.0
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] drm/gem: Correct error condition in drm_gem_objects_lookup
2025-11-24 11:20 [PATCH] drm/gem: Correct error condition in drm_gem_objects_lookup Steven Price
@ 2025-11-24 11:31 ` Tvrtko Ursulin
2025-11-26 11:21 ` Steven Price
1 sibling, 0 replies; 3+ messages in thread
From: Tvrtko Ursulin @ 2025-11-24 11:31 UTC (permalink / raw)
To: Steven Price, David Airlie, Maarten Lankhorst, Maxime Ripard,
Simona Vetter, Thomas Zimmermann
Cc: dri-devel, linux-kernel, André Almeida
On 24/11/2025 11:20, Steven Price wrote:
> When vmemdup_array_user() fails, 'handles' is set to a negative error
> code and no memory is allocated. So the call to kvfree() should not
> happen. Instead just return early with the error code.
Ah sorry about that. Must have mentally confused the two allocations.
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Regards,
Tvrtko
> Fixes: cb77b79abf5f ("drm/gem: Use vmemdup_array_user in drm_gem_objects_lookup")
> Signed-off-by: Steven Price <steven.price@arm.com>
> ---
> drivers/gpu/drm/drm_gem.c | 7 ++-----
> 1 file changed, 2 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
> index 68168d58a7c8..efc79bbf3c73 100644
> --- a/drivers/gpu/drm/drm_gem.c
> +++ b/drivers/gpu/drm/drm_gem.c
> @@ -798,13 +798,10 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles,
> *objs_out = objs;
>
> handles = vmemdup_array_user(bo_handles, count, sizeof(u32));
> - if (IS_ERR(handles)) {
> - ret = PTR_ERR(handles);
> - goto out;
> - }
> + if (IS_ERR(handles))
> + return PTR_ERR(handles);
>
> ret = objects_lookup(filp, handles, count, objs);
> -out:
> kvfree(handles);
> return ret;
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] drm/gem: Correct error condition in drm_gem_objects_lookup
2025-11-24 11:20 [PATCH] drm/gem: Correct error condition in drm_gem_objects_lookup Steven Price
2025-11-24 11:31 ` Tvrtko Ursulin
@ 2025-11-26 11:21 ` Steven Price
1 sibling, 0 replies; 3+ messages in thread
From: Steven Price @ 2025-11-26 11:21 UTC (permalink / raw)
To: David Airlie, Maarten Lankhorst, Maxime Ripard, Simona Vetter,
Thomas Zimmermann
Cc: dri-devel, linux-kernel, André Almeida, Tvrtko Ursulin
On 24/11/2025 11:20, Steven Price wrote:
> When vmemdup_array_user() fails, 'handles' is set to a negative error
> code and no memory is allocated. So the call to kvfree() should not
> happen. Instead just return early with the error code.
>
> Fixes: cb77b79abf5f ("drm/gem: Use vmemdup_array_user in drm_gem_objects_lookup")
> Signed-off-by: Steven Price <steven.price@arm.com>
Applied to drm-misc-next.
> ---
> drivers/gpu/drm/drm_gem.c | 7 ++-----
> 1 file changed, 2 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
> index 68168d58a7c8..efc79bbf3c73 100644
> --- a/drivers/gpu/drm/drm_gem.c
> +++ b/drivers/gpu/drm/drm_gem.c
> @@ -798,13 +798,10 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles,
> *objs_out = objs;
>
> handles = vmemdup_array_user(bo_handles, count, sizeof(u32));
> - if (IS_ERR(handles)) {
> - ret = PTR_ERR(handles);
> - goto out;
> - }
> + if (IS_ERR(handles))
> + return PTR_ERR(handles);
>
> ret = objects_lookup(filp, handles, count, objs);
> -out:
> kvfree(handles);
> return ret;
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-11-26 11:21 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-11-24 11:20 [PATCH] drm/gem: Correct error condition in drm_gem_objects_lookup Steven Price
2025-11-24 11:31 ` Tvrtko Ursulin
2025-11-26 11:21 ` Steven Price
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®