summaryrefslogtreecommitdiffstats
path: root/drivers/gpu/drm/drm_damage_helper.c
diff options
context:
space:
mode:
authorColin Ian King <colin.king@canonical.com>2018-12-22 14:00:46 +0100
committerDaniel Vetter <daniel.vetter@ffwll.ch>2018-12-24 11:52:43 +0100
commitcbdd2663f4c801ad93f7111f93d9846589a0d530 (patch)
treece2800348f3c1c9a83a792a49b692dd924565096 /drivers/gpu/drm/drm_damage_helper.c
parentMerge branch 'etnaviv/next' of https://git.pengutronix.de/git/lst/linux into ... (diff)
downloadlinux-cbdd2663f4c801ad93f7111f93d9846589a0d530.tar.xz
linux-cbdd2663f4c801ad93f7111f93d9846589a0d530.zip
drm: fix null pointer dereference on null state pointer
In the case where state cannot be allocated, the current exit path via label 'out' will dereference the null state pointer when calling drm_atomic_state_put. Fix this by adding a new error exit label and jumping to this to avoid the drm_atomic_state_put. Detected by CoverityScan, CID#1476034 ("Dereference after null check") Fixes: b9fc5e01d1ce ("drm: Add helper to implement legacy dirtyfb") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20181222130046.14083-1-colin.king@canonical.com
Diffstat (limited to 'drivers/gpu/drm/drm_damage_helper.c')
-rw-r--r--drivers/gpu/drm/drm_damage_helper.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_damage_helper.c b/drivers/gpu/drm/drm_damage_helper.c
index d2a1c7372f36..31032407254d 100644
--- a/drivers/gpu/drm/drm_damage_helper.c
+++ b/drivers/gpu/drm/drm_damage_helper.c
@@ -178,7 +178,7 @@ int drm_atomic_helper_dirtyfb(struct drm_framebuffer *fb,
state = drm_atomic_state_alloc(fb->dev);
if (!state) {
ret = -ENOMEM;
- goto out;
+ goto out_drop_locks;
}
state->acquire_ctx = &ctx;
@@ -238,6 +238,7 @@ out:
kfree(rects);
drm_atomic_state_put(state);
+out_drop_locks:
drm_modeset_drop_locks(&ctx);
drm_modeset_acquire_fini(&ctx);