drm/tilcdc: fix double kfree
authorGuido Martínez <guido@vanguardiasur.com.ar>
Tue, 17 Jun 2014 14:17:09 +0000 (11:17 -0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 5 Oct 2014 21:54:07 +0000 (14:54 -0700)
commit c9a3ad25eddfdb898114a9d73cdb4c3472d9dfca upstream.

display_timings_release calls kfree on the display_timings object passed
to it. Calling kfree after it is wrong. SLUB debug showed the following
warning:

    =============================================================================
    BUG kmalloc-64 (Tainted: G        W    ): Object already free
    -----------------------------------------------------------------------------

    Disabling lock debugging due to kernel taint
    INFO: Allocated in of_get_display_timings+0x2c/0x214 age=601 cpu=0
    pid=884
     __slab_alloc.constprop.79+0x2e0/0x33c
     kmem_cache_alloc+0xac/0xdc
     of_get_display_timings+0x2c/0x214
     panel_probe+0x7c/0x314 [tilcdc]
     platform_drv_probe+0x18/0x48
     [..snip..]
    INFO: Freed in panel_destroy+0x18/0x3c [tilcdc] age=0 cpu=0 pid=907
     __slab_free+0x34/0x330
     panel_destroy+0x18/0x3c [tilcdc]
     tilcdc_unload+0xd0/0x118 [tilcdc]
     drm_dev_unregister+0x24/0x98
     [..snip..]

Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
Tested-by: Darren Etheridge <detheridge@ti.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/gpu/drm/tilcdc/tilcdc_panel.c

index 2a93ea290c3e232299bd1f4d285b4b2a67bcc2e0..779d508616d3085882ed63e46fb1e50f38090b56 100644 (file)
@@ -286,10 +286,8 @@ static void panel_destroy(struct tilcdc_module *mod)
 {
        struct panel_module *panel_mod = to_panel_module(mod);
 
-       if (panel_mod->timings) {
+       if (panel_mod->timings)
                display_timings_release(panel_mod->timings);
-               kfree(panel_mod->timings);
-       }
 
        tilcdc_module_cleanup(mod);
        kfree(panel_mod->info);