diff mbox series

[5.7,029/120] drm: of: Fix double-free bug

Message ID	20200803121904.257261085@linuxfoundation.org
State	New
Headers	show Return-Path: <SRS0=5b7Y=BN=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Pavel Machek <pavel@denx.de>, Biju Das <biju.das.jz@bp.renesas.com>, Laurent Pinchart <laurent.pinchart@ideasonboard.com>, Sam Ravnborg <sam@ravnborg.org> Subject: [PATCH 5.7 029/120] drm: of: Fix double-free bug Date: Mon, 3 Aug 2020 14:18:07 +0200 Message-Id: <20200803121904.257261085@linuxfoundation.org> In-Reply-To: <20200803121902.860751811@linuxfoundation.org> References: <20200803121902.860751811@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.7,004/120] ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with A... [5.7,007/120] ALSA: hda/realtek - Fixed HP right speaker no sound [5.7,008/120] ALSA: hda: Workaround for spurious wakeups on some Intel platforms [5.7,009/120] ALSA: hda/hdmi: Fix keep_power assignment for non-component devices [5.7,011/120] IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE [5.7,012/120] vhost/scsi: fix up req type endian-ness [5.7,014/120] revert: 1320a4052ea1 ("audit: trigger accompanying records when no rules present") [5.7,016/120] ARM: 8987/1: VDSO: Fix incorrect clock_gettime64 [5.7,019/120] ARM: dts: imx6qdl-icore: Fix OTG_ID pin and sdcard detect [5.7,020/120] virtio_balloon: fix up endian-ness for free cmd id [5.7,022/120] ARM: percpu.h: fix build error [5.7,024/120] drm/amd/display: Clear dm_state for fast updates [5.7,025/120] drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl() [5.7,026/120] drm/dbi: Fix SPI Type 1 (9-bit) transfer [5.7,027/120] drm/mcde: Fix stability issue [5.7,029/120] drm: of: Fix double-free bug [5.7,031/120] random32: remove net_rand_state from the latent entropy gcc plugin [5.7,033/120] libtraceevent: Fix build with binutils 2.35 [5.7,037/120] ARM: dts sunxi: Relax a bit the CMA pool allocation range [5.7,039/120] espintcp: recv() should return 0 when the peer socket is closed [5.7,042/120] nvme-tcp: fix possible hang waiting for icresp response [5.7,043/120] selftests/net: rxtimestamp: fix clang issues for target arch PowerPC [5.7,045/120] selftests/net: so_txtime: fix clang issues for target arch PowerPC [5.7,046/120] selftests/net: tcp_mmap: fix clang warning for target arch PowerPC [5.7,050/120] net: hns3: fix a TX timeout issue [5.7,051/120] net: hns3: add reset check for VF updating port based VLAN [5.7,054/120] net/mlx5: E-switch, Destroy TSAR when fail to enable the mode [5.7,056/120] net/mlx5e: Fix error path of device attach [5.7,057/120] net/mlx5: Fix a bug of using ptp channel index as pin index [5.7,059/120] net/mlx5: Query PPS pin operational status before registering it [5.7,062/120] net: lan78xx: add missing endpoint sanity check [5.7,063/120] net: lan78xx: fix transfer-buffer memory leak [5.7,065/120] mlx4: disable device on shutdown [5.7,067/120] octeontx2-pf: cancel reset_task work [5.7,069/120] bareudp: forbid mixing IP and MPLS in multiproto mode [5.7,071/120] mlxsw: core: Increase scope of RCU read-side critical section [5.7,072/120] mlxsw: core: Free EMAD transactions using kfree_rcu() [5.7,073/120] mlxsw: spectrum_router: Fix use-after-free in router init / de-init [5.7,075/120] ibmvnic: Fix IRQ mapping disposal in error path [5.7,076/120] bpf: Fix map leak in HASH_OF_MAPS map [5.7,079/120] mac80211: mesh: Free pending skb when destroying a mpath [5.7,080/120] RDMA/core: Stop DIM before destroying CQ [5.7,083/120] arm64: csum: Fix handling of bad packets [5.7,086/120] net: nixge: fix potential memory leak in nixge_probe() [5.7,087/120] net: ethernet: mtk_eth_soc: fix MTU warnings [5.7,091/120] net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq [5.7,094/120] mt76: mt7615: fix lmac queue debugsfs entry [5.7,095/120] iwlwifi: fix crash in iwl_dbg_tlv_alloc_trigger [5.7,096/120] usb: hso: Fix debug compile warning on sparc32 [5.7,101/120] habanalabs: prevent possible out-of-bounds array access [5.7,103/120] scsi: core: Run queue in case of I/O resource contention failure [5.7,104/120] riscv: kasan: use local_tlb_flush_all() to avoid uninitialized __sbi_rfence [5.7,106/120] net: ethernet: ravb: exit if re-initialization fails in tx timeout [5.7,109/120] i2c: cadence: Clear HOLD bit at correct time in Rx path [5.7,111/120] x86/stacktrace: Fix reliable check for empty user task stacks [5.7,112/120] cxgb4: add missing release on skb in uld_send() [5.7,113/120] xen-netfront: fix potential deadlock in xennet_remove() [5.7,118/120] KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled [5.7,119/120] KVM: SVM: Fix disable pause loop exit/pause filtering capability on SVM

Commit Message

Greg KH Aug. 3, 2020, 12:18 p.m. UTC

From: Biju Das <biju.das.jz@bp.renesas.com>

commit 4ee48cc5586bf519df19894273002aa8ef7b70ad upstream.

Fix double-free bug in the error path.

Fixes: 6529007522de ("drm: of: Add drm_of_lvds_get_dual_link_pixel_order")
Reported-by: Pavel Machek <pavel@denx.de>
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/1595502654-40595-1-git-send-email-biju.das.jz@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/drm_of.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff mbox series

Patch

--- a/drivers/gpu/drm/drm_of.c
+++ b/drivers/gpu/drm/drm_of.c
@@ -322,10 +322,8 @@  static int drm_of_lvds_get_remote_pixels
 		 * configurations by passing the endpoints explicitly to
 		 * drm_of_lvds_get_dual_link_pixel_order().
 		 */
-		if (!current_pt || pixels_type != current_pt) {
-			of_node_put(remote_port);
+		if (!current_pt || pixels_type != current_pt)
 			return -EINVAL;
-		}
 	}
 
 	return pixels_type;