drm/virtio: Fix a double free in virtio_gpu_cmd_map()
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 30 Oct 2020 11:48:08 +0000 (14:48 +0300)
committerGerd Hoffmann <kraxel@redhat.com>
Fri, 6 Nov 2020 07:50:30 +0000 (08:50 +0100)
This is freed both here and in the caller (virtio_gpu_vram_map()) so
it's a double free.  The correct place is only in the caller.

Fixes: 16845c5d5409 ("drm/virtio: implement blob resources: implement vram object")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Gurchetan Singh <gurchetansingh@chromium.org>
Link: http://patchwork.freedesktop.org/patch/msgid/20201030114808.GD3251003@mwanda
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
drivers/gpu/drm/virtio/virtgpu_vq.c

index 857f730747b61c099484909b0fcf88bbf82b07ad..cf84d382dd41d7e4d010c52bbbd634a951bc3ff9 100644 (file)
@@ -1211,10 +1211,8 @@ int virtio_gpu_cmd_map(struct virtio_gpu_device *vgdev,
        struct virtio_gpu_resp_map_info *resp_buf;
 
        resp_buf = kzalloc(sizeof(*resp_buf), GFP_KERNEL);
-       if (!resp_buf) {
-               virtio_gpu_array_put_free(objs);
+       if (!resp_buf)
                return -ENOMEM;
-       }
 
        cmd_p = virtio_gpu_alloc_cmd_resp
                (vgdev, virtio_gpu_cmd_resource_map_cb, &vbuf, sizeof(*cmd_p),