diff options
| author | Christophe JAILLET <christophe.jaillet@wanadoo.fr> | 2017-11-09 18:09:28 +0100 |
|---|---|---|
| committer | Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> | 2017-11-09 18:09:28 +0100 |
| commit | 2e307cba0c56eba45649eb0f0f43b999e64aae94 (patch) | |
| tree | ad7b7966aa420b6afd3da33b02381e54b2d10fc3 /drivers/video/fbdev/au1200fb.c | |
| parent | cb6bc3ff59e3ff7a6fba8ca6ee649d532b4e17f2 (diff) | |
| download | linux-stable-2e307cba0c56eba45649eb0f0f43b999e64aae94.tar.gz linux-stable-2e307cba0c56eba45649eb0f0f43b999e64aae94.tar.bz2 linux-stable-2e307cba0c56eba45649eb0f0f43b999e64aae94.zip | |
video: fbdev: au1200fb: Fix a potential double free
If 'fb_alloc_cmap()' fails, 'fbi->pseudo_palette' is freed and an error
code is returned by 'au1200fb_init_fbinfo()'.
The only caller, 'au1200fb_drv_probe()' goes to an error handling path
where resources allocated in 'fb_alloc_cmap()' are freed.
This leads to a double free of 'fbi->pseudo_palette'.
Fix it by letting the caller free all resources in case of failure in
'au1200fb_init_fbinfo()'.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Diffstat (limited to 'drivers/video/fbdev/au1200fb.c')
| -rw-r--r-- | drivers/video/fbdev/au1200fb.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/video/fbdev/au1200fb.c b/drivers/video/fbdev/au1200fb.c index 5f04b4096c42..a5facc2ad90b 100644 --- a/drivers/video/fbdev/au1200fb.c +++ b/drivers/video/fbdev/au1200fb.c @@ -1553,7 +1553,6 @@ static int au1200fb_init_fbinfo(struct au1200fb_device *fbdev) if (fb_alloc_cmap(&fbi->cmap, AU1200_LCD_NBR_PALETTE_ENTRIES, 0) < 0) { print_err("Fail to allocate colormap (%d entries)", AU1200_LCD_NBR_PALETTE_ENTRIES); - kfree(fbi->pseudo_palette); return -EFAULT; } |