Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755277AbbFCLXC (ORCPT ); Wed, 3 Jun 2015 07:23:02 -0400 Received: from mx1.redhat.com ([209.132.183.28]:55636 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753966AbbFCLJ5 (ORCPT ); Wed, 3 Jun 2015 07:09:57 -0400 From: Frediano Ziglio To: fziglio@redhat.com, spice-devel@lists.freedesktop.org, airlied@linux.ie, dri-devel@lists.freedesktop.org, airlied@redhat.com Cc: linux-kernel@vger.kernel.org Subject: [PATCH 04/11] drm/qxl: Avoid double free on error Date: Wed, 3 Jun 2015 12:09:12 +0100 Message-Id: <1433329759-10082-5-git-send-email-fziglio@redhat.com> In-Reply-To: <1433329759-10082-1-git-send-email-fziglio@redhat.com> References: <1433329759-10082-1-git-send-email-fziglio@redhat.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1232 Lines: 32 Is we are not able to get source bo object from handle we free destination bo object and call cleanup code however destination object was already inserted in reloc_info array (num_relocs was already incremented) so on cleanup we free destination again. Signed-off-by: Frediano Ziglio Reviewed-by: Dave Airlie --- drivers/gpu/drm/qxl/qxl_ioctl.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index 230ab84..85b3808 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -240,8 +240,6 @@ static int qxl_process_single_command(struct qxl_device *qdev, qxlhw_handle_to_bo(qdev, file_priv, reloc.src_handle, release); if (!reloc_info[i].src_bo) { - if (reloc_info[i].dst_bo != cmd_bo) - drm_gem_object_unreference_unlocked(&reloc_info[i].dst_bo->gem_base); ret = -EINVAL; goto out_free_bos; } -- 2.1.0 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/