diff options
| author |   Dave Airlie <airlied@redhat.com> | 2019-09-06 16:23:25 +1000 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2019-09-06 16:24:56 +1000 |
| commit | 7610bb0bde4c210212cdbb3be9b502eaad10731a (patch) | |
| tree | 242ab45fb3ca24d44787364ceb5c3231d1945d36 /drivers | |
| parent | Merge branch 'linux-5.3' of git://github.com/skeggsb/linux into drm-fixes (diff) | |
| parent | drm/vmwgfx: Fix double free in vmw_recv_msg() (diff) | |
| download | linux-dev-7610bb0bde4c210212cdbb3be9b502eaad10731a.tar.xz linux-dev-7610bb0bde4c210212cdbb3be9b502eaad10731a.zip | |
Merge branch 'vmwgfx-fixes-5.3' of git://people.freedesktop.org/~thomash/linux into drm-fixes
Single vmwgfx double free fix.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c index 59e9d05ab928..0af048d1a815 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c @@ -353,7 +353,7 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg, !!(HIGH_WORD(ecx) & MESSAGE_STATUS_HB)); if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) == 0) { kfree(reply); - + reply = NULL; if ((HIGH_WORD(ebx) & MESSAGE_STATUS_CPT) != 0) { /* A checkpoint occurred. Retry. */ continue; @@ -377,7 +377,7 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg, if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0) { kfree(reply); - + reply = NULL; if ((HIGH_WORD(ecx) & MESSAGE_STATUS_CPT) != 0) { /* A checkpoint occurred. Retry. */ continue; @@ -389,10 +389,8 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg, break; } - if (retries == RETRIES) { - kfree(reply); + if (!reply) return -EINVAL; - } *msg_len = reply_len; *msg = reply; |