提交 f48bb04a 编写于 作者: J Julia Lawall 提交者: Dave Airlie

drivers/gpu/drm/radeon/radeon_cs.c: eliminate possible double free

The function radeon_cs_parser_init is only called from two places, in
drivers/gpu/drm/radeon/radeon_cs.c and drivers/gpu/drm/radeon/r600_cs.c.
In each case, if the call fails another function is called that frees all
of the kdata and dpage information in the chunks array.  So this
information should not be freed in radeon_cs_parser_init as well.
Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Reviewed-by: NJerome Glisse <jglisse@redhat.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>
上级 abc8113f
......@@ -243,20 +243,11 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
if ((p->cs_flags & RADEON_CS_USE_VM) &&
!p->rdev->vm_manager.enabled) {
DRM_ERROR("VM not active on asic!\n");
if (p->chunk_relocs_idx != -1)
kfree(p->chunks[p->chunk_relocs_idx].kdata);
if (p->chunk_flags_idx != -1)
kfree(p->chunks[p->chunk_flags_idx].kdata);
return -EINVAL;
}
if (radeon_cs_get_ring(p, ring, priority)) {
if (p->chunk_relocs_idx != -1)
kfree(p->chunks[p->chunk_relocs_idx].kdata);
if (p->chunk_flags_idx != -1)
kfree(p->chunks[p->chunk_flags_idx].kdata);
if (radeon_cs_get_ring(p, ring, priority))
return -EINVAL;
}
/* deal with non-vm */
......@@ -271,11 +262,8 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
p->chunks[p->chunk_ib_idx].kpage[0] = kmalloc(PAGE_SIZE, GFP_KERNEL);
p->chunks[p->chunk_ib_idx].kpage[1] = kmalloc(PAGE_SIZE, GFP_KERNEL);
if (p->chunks[p->chunk_ib_idx].kpage[0] == NULL ||
p->chunks[p->chunk_ib_idx].kpage[1] == NULL) {
kfree(p->chunks[p->chunk_ib_idx].kpage[0]);
kfree(p->chunks[p->chunk_ib_idx].kpage[1]);
p->chunks[p->chunk_ib_idx].kpage[1] == NULL)
return -ENOMEM;
}
p->chunks[p->chunk_ib_idx].kpage_idx[0] = -1;
p->chunks[p->chunk_ib_idx].kpage_idx[1] = -1;
p->chunks[p->chunk_ib_idx].last_copied_page = -1;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册