system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-09-22 03:55:39 +00:00
Code Issues Packages Projects Releases Wiki Activity
linux/drivers/gpu/drm
History
Dan Carpenter 08b0c89160 drm/vmwgfx: Fix double free in vmw_recv_msg() 
We recently added a kfree() after the end of the loop:

	if (retries == RETRIES) {
		kfree(reply);
		return -EINVAL;
	}

There are two problems.  First the test is wrong and because retries
equals RETRIES if we succeed on the last iteration through the loop.
Second if we fail on the last iteration through the loop then the kfree
is a double free.

When you're reading this code, please note the break statement at the
end of the while loop.  This patch changes the loop so that if it's not
successful then "reply" is NULL and we can test for that afterward.

Cc: <stable@vger.kernel.org>
Fixes: 6b7c3b86f0 ("drm/vmwgfx: fix memory leak when too many retries have occurred")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
2019-09-05 14:44:28 +02:00
..
amd Revert "drm/amdkfd: New IOCTL to allocate queue GWS" 2019-08-07 10:21:38 -05:00
arc treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
arm drm/komeda: Computing image enhancer internally 2019-07-08 15:05:34 +01:00
armada drm main pull request for v5.3-rc1 (sans mm changes) 2019-07-15 19:04:27 -07:00
aspeed treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
ast drm/ast: Pin framebuffer BO during dirty update 2019-06-13 13:37:19 +02:00
atmel-hlcdc drm main pull request for v5.3-rc1 (sans mm changes) 2019-07-15 19:04:27 -07:00
bochs drm/bochs: Use shadow buffer for bochs framebuffer console 2019-08-01 15:01:42 +02:00
bridge drm/bridge: tc358764: Fix build error 2019-07-30 15:07:35 +02:00
cirrus Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
etnaviv drm main pull request for v5.3-rc1 (sans mm changes) 2019-07-15 19:04:27 -07:00
exynos drm/exynos: fix missing decrement of retry counter 2019-08-02 16:50:18 +09:00
fsl-dcu treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
gma500 Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
hisilicon drm main pull request for v5.3-rc1 (sans mm changes) 2019-07-15 19:04:27 -07:00
i2c drm main pull request for v5.3-rc1 (sans mm changes) 2019-07-15 19:04:27 -07:00
i810 treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
i915 drm/i915: Only recover active engines 2019-08-01 13:22:00 +03:00
imx drm main pull request for v5.3-rc1 (sans mm changes) 2019-07-15 19:04:27 -07:00
ingenic DRM: Add KMS driver for the Ingenic JZ47xx SoCs 2019-06-19 13:24:14 +02:00
lib
lima drm/lima: add timeout to drm scheduler init 2019-05-21 20:47:36 +08:00
mcde drm/mcde: Fix an uninitialized variable 2019-06-13 11:55:23 +02:00
mediatek Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
meson Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
mga treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
mgag200 Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
msm drm: msm: Fix add_gpu_components 2019-08-01 12:52:21 -04:00
mxsfb treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
nouveau drm pull fixes for 5.3-rc3 2019-08-02 08:50:37 -07:00
omapdrm drm main pull request for v5.3-rc1 (sans mm changes) 2019-07-15 19:04:27 -07:00
panel drm main pull request for v5.3-rc1 (sans mm changes) 2019-07-15 19:04:27 -07:00
panfrost drm main pull request for v5.3-rc1 (sans mm changes) 2019-07-15 19:04:27 -07:00
pl111 treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
qxl Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
r128 drm/r128: drop use of drmP.h 2019-06-05 20:31:19 +02:00
radeon Merge branch 'drm-next' into drm-next-5.3 2019-06-25 08:42:25 -05:00
rcar-du drm/rcar-du: Fix error check when retrieving crtc state 2019-06-18 11:44:00 -04:00
rockchip drm main pull request for v5.3-rc1 (sans mm changes) 2019-07-15 19:04:27 -07:00
savage drm/savage: drop use of drmP.h 2019-06-05 20:31:04 +02:00
scheduler drm/sched: Fix make htmldocs warnings. 2019-05-29 11:49:51 -05:00
selftests drm/selftests: reduce stack usage 2019-07-01 09:50:58 +02:00
shmobile video: backlight: Remove useless BACKLIGHT_LCD_SUPPORT kernel symbol 2019-04-03 11:15:57 +01:00
sis drm/sis: drop drmP.h use 2019-06-05 20:29:57 +02:00
sti sti: no need to check return value of debugfs_create functions 2019-06-13 17:35:49 +02:00
stm drm/stm: drv: fix suspend/resume 2019-06-20 17:03:24 +02:00
sun4i Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
tdfx treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
tegra drm/tegra: Fix gpiod_get_from_of_node() regression 2019-07-25 15:23:26 +02:00
tilcdc treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
tinydrm treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ttm Merge tag 'drm-fixes-5.3-2019-07-24' of git://people.freedesktop.org/~agd5f/linux into drm-fixes 2019-07-26 14:10:26 +10:00
tve200 treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 443 2019-06-05 17:37:17 +02:00
udl treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 262 2019-06-05 17:30:28 +02:00
v3d drm-misc-next for v5.3, try #2: 2019-05-28 08:59:11 +10:00
vboxvideo Merge drm/drm-next into drm-misc-next 2019-05-22 16:08:21 -04:00
vc4 drm main pull request for v5.3-rc1 (sans mm changes) 2019-07-15 19:04:27 -07:00
vgem Revert "drm/vgem: fix cache synchronization on arm/arm64" 2019-08-02 17:05:55 +02:00
via treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
virtio drm main pull request for v5.3-rc1 (sans mm changes) 2019-07-15 19:04:27 -07:00
vkms drm/vkms: add crc sources list 2019-06-18 22:56:31 -03:00
vmwgfx drm/vmwgfx: Fix double free in vmw_recv_msg() 2019-09-05 14:44:28 +02:00
xen treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
zte drm main pull request for v5.3-rc1 (sans mm changes) 2019-07-15 19:04:27 -07:00
ati_pcigart.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_agpsupport.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_atomic.c drm: Add helpers to kick off self refresh mode in drivers 2019-06-13 14:31:10 -04:00
drm_atomic_helper.c Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
drm_atomic_state_helper.c drm/atomic: Add a function to reset connector TV properties 2019-06-19 12:17:52 +02:00
drm_atomic_uapi.c drm: Add helpers to kick off self refresh mode in drivers 2019-06-13 14:31:10 -04:00
drm_auth.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_blend.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_bridge.c drm: Add atomic variants for bridge enable/disable 2019-06-13 13:00:29 -04:00
drm_bufs.c drm main pull request for v5.3-rc1 (sans mm changes) 2019-07-15 19:04:27 -07:00
drm_cache.c
drm_client.c drm/fb-helper: Map DRM client buffer only when required 2019-08-01 15:01:29 +02:00
drm_client_modeset.c drm/modes: Don't apply cmdline's rotation if it wasn't specified 2019-07-16 10:34:38 +02:00
drm_color_mgmt.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_connector.c drm: connector: remove bogus NULL check 2019-07-02 15:39:32 +02:00
drm_context.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_crtc.c drm: no need to check return value of debugfs_create functions 2019-06-13 16:39:16 +02:00
drm_crtc_helper.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_crtc_helper_internal.h
drm_crtc_internal.h drm/atomic: Move __drm_atomic_helper_disable_plane/set_config() 2019-06-08 16:46:37 +02:00
drm_damage_helper.c drm/damage-helper: Use NULL instead of 0 2019-05-28 09:03:06 +02:00
drm_debugfs.c drm: debugfs: make drm_debugfs_create_files() never fail 2019-06-14 16:59:51 +02:00
drm_debugfs_crc.c drm: no need to check return value of debugfs_create functions 2019-06-13 16:39:16 +02:00
drm_dma.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_dp_aux_dev.c drm/dp: drmP.h include removal 2019-05-06 16:00:48 +03:00
drm_dp_cec.c
drm_dp_dual_mode_helper.c drm/dp: drmP.h include removal 2019-05-06 16:00:48 +03:00
drm_dp_helper.c drm/dp: Add DP_DPCD_QUIRK_NO_SINK_COUNT 2019-06-14 19:11:10 +03:00
drm_dp_mst_topology.c drm/mst: Fix MST sideband up-reply failure handling 2019-05-29 20:12:34 +03:00
drm_drv.c Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-07-19 10:42:02 -07:00
drm_dsc.c drm/dsc: Split DSC PPS and SDP header initialisations 2019-03-05 13:24:34 -05:00
drm_dumb_buffers.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_edid.c drm/edid: use for_each_displayid_db where applicable 2019-06-25 14:44:03 +10:00
drm_edid_load.c Merge remote-tracking branch 'drm/drm-next' into drm-misc-next 2019-05-28 09:39:08 +02:00
drm_encoder.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_encoder_slave.c
drm_fb_cma_helper.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
drm_fb_helper.c drm/fb-helper: Instanciate shadow FB if configured in device's mode_config 2019-08-01 15:01:35 +02:00
drm_file.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_flip_work.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_format_helper.c drm: Remove users of drm_format_info_plane_cpp 2019-05-20 13:35:56 +02:00
drm_fourcc.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_framebuffer.c drm: silence variable 'conn' set but not used 2019-07-22 16:04:53 -04:00
drm_gem.c drm/gem: Unexport drm_gem_(un)pin/v(un)map 2019-06-17 17:37:01 +02:00
drm_gem_cma_helper.c Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
drm_gem_framebuffer_helper.c Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
drm_gem_shmem_helper.c drm/gem_shmem: Use a writecombine mapping for ->vaddr 2019-06-10 09:14:01 -06:00
drm_gem_vram_helper.c drm: Remove functions with kmap-object argument from GEM VRAM helpers 2019-06-13 13:37:36 +02:00
drm_hashtab.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_hdcp.c drm/hdcp: drm_hdcp_request_srm() as static 2019-05-13 22:05:54 +02:00
drm_internal.h drm/gem: Unexport drm_gem_(un)pin/v(un)map 2019-06-17 17:37:01 +02:00
drm_ioc32.c drm main pull request for v5.3-rc1 (sans mm changes) 2019-07-15 19:04:27 -07:00
drm_ioctl.c docs conversion for v5.3-rc1 2019-07-16 12:21:41 -07:00
drm_irq.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_kms_helper_common.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_lease.c Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
drm_legacy.h drm: make drm_legacy.h self-contained 2019-05-27 18:06:47 +02:00
drm_legacy_misc.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_lock.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_memory.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_mipi_dsi.c bus_find_device: Unify the match callback with class_find_device 2019-06-24 05:22:31 +02:00
drm_mm.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_mode_config.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_mode_object.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_modes.c Merge branch 'pdf_fixes_v1' of https://git.linuxtv.org/mchehab/experimental into mauro 2019-07-22 13:51:20 -06:00
drm_modeset_helper.c drm: prepare for drmP.h removal from drm_modeset_helper.h 2019-02-07 21:48:28 +01:00
drm_modeset_lock.c docs conversion for v5.3-rc1 2019-07-16 12:21:41 -07:00
drm_of.c Merge remote-tracking branch 'drm/drm-next' into drm-misc-next 2019-05-28 09:39:08 +02:00
drm_panel.c drm/panel: Small documentation polish 2019-01-12 13:08:12 +01:00
drm_panel_orientation_quirks.c drm: panel-orientation-quirks: Add extra quirk table entry for GPD MicroPC 2019-07-01 16:58:09 +02:00
drm_pci.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_plane.c drm/lease: Make sure implicit planes are leased 2019-04-24 11:30:32 +02:00
drm_plane_helper.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_prime.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_print.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_probe_helper.c Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
drm_property.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_rect.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_scatter.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_scdc_helper.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_self_refresh_helper.c drm/self_refresh: Fix possible NULL deref in failure path 2019-06-20 10:03:21 -04:00
drm_simple_kms_helper.c Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
drm_syncobj.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_sysfs.c Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
drm_trace.h drm: make drm_trace.h self-contained 2019-05-27 18:06:54 +02:00
drm_trace_points.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_vblank.c drm: add debug print to update_vblank_count 2019-06-14 19:10:04 +03:00
drm_vm.c drm: Permit video-buffers writecombine mapping for MIPS 2019-06-18 15:41:33 -04:00
drm_vma_manager.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_vram_helper_common.c drm: Replace drm_gem_vram_push_to_system() with kunmap + unpin 2019-05-22 12:43:29 +02:00
drm_vram_mm_helper.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
drm_writeback.c drm: drop use of drmP.h in drm/* 2019-05-27 18:07:03 +02:00
Kconfig drm/i810: Use CONFIG_PREEMPTION 2019-07-31 17:05:03 +02:00
Makefile DRM: Add KMS driver for the Ingenic JZ47xx SoCs 2019-06-19 13:24:14 +02:00