Commit f7b83b90 authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Dave Airlie

drm/edid: Fix potential memory leak in edid_load()

Do not leak memory by updating pointer with potentially
NULL realloc return value.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Reviewed-by: default avatarCarsten Emde <C.Emde@osadl.org>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent 959f7247
...@@ -119,7 +119,7 @@ static int edid_load(struct drm_connector *connector, char *name, ...@@ -119,7 +119,7 @@ static int edid_load(struct drm_connector *connector, char *name,
{ {
const struct firmware *fw; const struct firmware *fw;
struct platform_device *pdev; struct platform_device *pdev;
u8 *fwdata = NULL, *edid; u8 *fwdata = NULL, *edid, *new_edid;
int fwsize, expected; int fwsize, expected;
int builtin = 0, err = 0; int builtin = 0, err = 0;
int i, valid_extensions = 0; int i, valid_extensions = 0;
...@@ -195,12 +195,14 @@ static int edid_load(struct drm_connector *connector, char *name, ...@@ -195,12 +195,14 @@ static int edid_load(struct drm_connector *connector, char *name,
"\"%s\" for connector \"%s\"\n", valid_extensions, "\"%s\" for connector \"%s\"\n", valid_extensions,
edid[0x7e], name, connector_name); edid[0x7e], name, connector_name);
edid[0x7e] = valid_extensions; edid[0x7e] = valid_extensions;
edid = krealloc(edid, (valid_extensions + 1) * EDID_LENGTH, new_edid = krealloc(edid, (valid_extensions + 1) * EDID_LENGTH,
GFP_KERNEL); GFP_KERNEL);
if (edid == NULL) { if (new_edid == NULL) {
err = -ENOMEM; err = -ENOMEM;
kfree(edid);
goto relfw_out; goto relfw_out;
} }
edid = new_edid;
} }
connector->display_info.raw_edid = edid; connector->display_info.raw_edid = edid;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment