[lkml]   [2013]   [Feb]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[ 094/128] drm/radeon: fix a rare case of double kfree
    3.2-stable review patch.  If anyone has any objections, please let me know.


    From: Ilija Hadzic <>

    commit 1da80cfa8727abf404fcee44d04743febea54069 upstream.

    If one (but not both) allocations of p->chunks[].kpage[]
    in radeon_cs_parser_init fail, the error path will free
    the successfully allocated page, but leave a stale pointer
    value in the kpage[] field. This will later cause a
    double-free when radeon_cs_parser_fini is called.
    This patch fixes the issue by forcing both pointers to NULL
    after kfree in the error path.

    The circumstances under which the problem happens are very
    rare. The card must be AGP and the system must run out of
    kmalloc area just at the right time so that one allocation
    succeeds, while the other fails.

    Signed-off-by: Ilija Hadzic <>
    Cc: Herton Ronaldo Krzesinski <>
    Signed-off-by: Alex Deucher <>
    [bwh: Backported to 3.2: s/p->chunk_ib_idx/i/]
    Signed-off-by: Ben Hutchings <>
    drivers/gpu/drm/radeon/radeon_cs.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/drivers/gpu/drm/radeon/radeon_cs.c
    +++ b/drivers/gpu/drm/radeon/radeon_cs.c
    @@ -168,6 +168,8 @@ int radeon_cs_parser_init(struct radeon_
    if (p->chunks[i].kpage[0] == NULL || p->chunks[i].kpage[1] == NULL) {
    + p->chunks[i].kpage[0] = NULL;
    + p->chunks[i].kpage[1] = NULL;
    return -ENOMEM;
    p->chunks[i].kpage_idx[0] = -1;

     \ /
      Last update: 2013-02-03 17:01    [W:7.765 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site