Unverified Commit ec7d7879 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!3631 drm: fix free illegal pointer when create drm_property_blob failed 

Merge Pull Request from: @ci-robot 
 
PR sync from: zhangnaichuan <zhangnaichuan@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/5SWGKLAEEMIDPZ7V7JU623REXLUUPIP3/ 
we get (Unable to handle kernel NULL pointer dereference at virtual
address 000000000000000c) when call drm_property_blob_put().
After analysis, we get the following process:
alloc failed:
drm_property_create_blob() // failed
free illegal pointer:
__drm_atomic_helper_crtc_destroy_state()
So do we have to determine if blob is an error code

Fixes: 6bcacf51 (drm: Add reference counting to blob properties)


-- 
2.33.0
 
https://gitee.com/openeuler/kernel/issues/I8RJA9?from=project-issue 
 
Link:https://gitee.com/openeuler/kernel/pulls/3631

 

Reviewed-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
Acked-by: default avatarXie XiuQi <xiexiuqi@huawei.com>
parents 4ebad855 4f018ed6

drivers/gpu/drm/drm_property.c

+1 −1
Original line number Diff line number Diff line
@@ -599,7 +599,7 @@ EXPORT_SYMBOL(drm_property_create_blob); 
 */

void drm_property_blob_put(struct drm_property_blob *blob)

{

	if (!blob)

	if (IS_ERR_OR_NULL(blob))

		return;



	drm_mode_object_put(&blob->base);