diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-02-26 23:48:23 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-02-26 23:48:23 -0800 |
| commit | 03c6cbcaf3da9a00e6bb43642208a88090db817c (patch) | |
| tree | d6624ae46ae382708e7cc8d55c80be057dfa1995 /drivers/video/fbdev | |
| parent | 0308c156c172e478dcde2981d5da6f5edf9dd05a (diff) | |
| parent | 3ce6c47d2142fcd2c4c1181afe08630aaae5a267 (diff) | |
Merge "msm : mdss: Avoid arbitrary free of scale_data in error condition"
Diffstat (limited to 'drivers/video/fbdev')
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_fb.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/video/fbdev/msm/mdss_fb.c b/drivers/video/fbdev/msm/mdss_fb.c index 636eea3c9bcc..db27842eaccc 100644 --- a/drivers/video/fbdev/msm/mdss_fb.c +++ b/drivers/video/fbdev/msm/mdss_fb.c @@ -4479,7 +4479,7 @@ err: static int __mdss_fb_copy_destscaler_data(struct fb_info *info, struct mdp_layer_commit *commit) { - int i; + int i = 0; int ret = 0; u32 data_size; struct mdp_destination_scaler_data __user *ds_data_user; @@ -4552,6 +4552,7 @@ static int __mdss_fb_copy_destscaler_data(struct fb_info *info, data_size); if (ret) { pr_err("scale data copy from user failed\n"); + kfree(scale_data); goto err; } } @@ -4561,7 +4562,7 @@ static int __mdss_fb_copy_destscaler_data(struct fb_info *info, err: if (ds_data) { - for (i = 0; i < commit->commit_v1.dest_scaler_cnt; i++) { + for (i--; i >= 0; i--) { scale_data = to_user_ptr(ds_data[i].scale); kfree(scale_data); } |