From 2e307cba0c56eba45649eb0f0f43b999e64aae94 Mon Sep 17 00:00:00 2001 From: Christophe JAILLET Date: Thu, 9 Nov 2017 18:09:28 +0100 Subject: [PATCH] video: fbdev: au1200fb: Fix a potential double free If 'fb_alloc_cmap()' fails, 'fbi->pseudo_palette' is freed and an error code is returned by 'au1200fb_init_fbinfo()'. The only caller, 'au1200fb_drv_probe()' goes to an error handling path where resources allocated in 'fb_alloc_cmap()' are freed. This leads to a double free of 'fbi->pseudo_palette'. Fix it by letting the caller free all resources in case of failure in 'au1200fb_init_fbinfo()'. Signed-off-by: Christophe JAILLET Cc: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz --- drivers/video/fbdev/au1200fb.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/video/fbdev/au1200fb.c b/drivers/video/fbdev/au1200fb.c index 5f04b4096c42..a5facc2ad90b 100644 --- a/drivers/video/fbdev/au1200fb.c +++ b/drivers/video/fbdev/au1200fb.c @@ -1553,7 +1553,6 @@ static int au1200fb_init_fbinfo(struct au1200fb_device *fbdev) if (fb_alloc_cmap(&fbi->cmap, AU1200_LCD_NBR_PALETTE_ENTRIES, 0) < 0) { print_err("Fail to allocate colormap (%d entries)", AU1200_LCD_NBR_PALETTE_ENTRIES); - kfree(fbi->pseudo_palette); return -EFAULT; }