mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-26 20:38:12 +00:00
drm/tegra: put drm_gem_object ref on error in tegra_fb_create
[ Upstream commit32e5a120a5
] Inside tegra_fb_create(), drm_gem_object_lookup() increments ref count of the found object. But if the following size check fails then the last found object's ref count should be put there as the unreferencing loop can't detect this situation. Found by Linux Verification Center (linuxtesting.org). Fixes:de2ba664c3
("gpu: host1x: drm: Add memory manager and fb") Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patchwork.freedesktop.org/patch/msgid/20231215093356.12067-1-pchelkin@ispras.ru Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
3f8445f1c7
commit
240c4f1159
1 changed files with 1 additions and 0 deletions
|
@ -165,6 +165,7 @@ struct drm_framebuffer *tegra_fb_create(struct drm_device *drm,
|
|||
|
||||
if (gem->size < size) {
|
||||
err = -EINVAL;
|
||||
drm_gem_object_put(gem);
|
||||
goto unreference;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue