diff options
| author | Martin Peres <[email protected]> | 2017-01-18 23:49:21 +0200 |
|---|---|---|
| committer | Ben Skeggs <[email protected]> | 2017-02-17 17:38:07 +1000 |
| commit | ca33fafdc9020720a9773fd416c94fe68aef7220 (patch) | |
| tree | 848b32bd759563eef03461a357c687d250fc2fc8 | |
| parent | 443828fd9e6097464aa3fd32199bbba3a3bf7e88 (diff) | |
drm/nouveau/drm/nouveau/led: prevent a possible use-after-free
If the led class registration fails, we free drm->led but do not reset
it to NULL, which means that the suspend/resume/fini function will act
as if everything went well in init() and will likely crash the kernel.
This patch adds the missing drm->led = NULL.
Reported-by: Emmanuel Pescosta <[email protected]>
Signed-off-by: Martin Peres <[email protected]>
Signed-off-by: Ben Skeggs <[email protected]>
| -rw-r--r-- | drivers/gpu/drm/nouveau/nouveau_led.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/gpu/drm/nouveau/nouveau_led.c b/drivers/gpu/drm/nouveau/nouveau_led.c index 72456b1693a4..2c5e0628da12 100644 --- a/drivers/gpu/drm/nouveau/nouveau_led.c +++ b/drivers/gpu/drm/nouveau/nouveau_led.c @@ -102,6 +102,7 @@ nouveau_led_init(struct drm_device *dev) ret = led_classdev_register(dev->dev, &drm->led->led); if (ret) { kfree(drm->led); + drm->led = NULL; return ret; } |