In function virtio_gpu_conn_destroy a pointer to a containing structure virtio_gpu_output is received using drm_connector_to_virtio_gpu_output (container_of), and then it is passed to kfree function.
But this pointer points to a member of array (vgdev->outputs + index) (see vgdev_output_init):
struct virtio_gpu_output *output = vgdev->outputs + index; struct drm_connector *connector = &output->conn; ... drm_connector_init(dev, connector, &virtio_gpu_connector_funcs, DRM_MODE_CONNECTOR_VIRTUAL);
Signed-off-by: Damir Shaikhutdinov damir.shaikhutdinov@opensynergy.com --- drivers/gpu/drm/virtio/virtgpu_display.c | 4 ---- 1 file changed, 4 deletions(-)
diff --git a/drivers/gpu/drm/virtio/virtgpu_display.c b/drivers/gpu/drm/virtio/virtgpu_display.c index b6d52055a11f..d211d4e98b46 100644 --- a/drivers/gpu/drm/virtio/virtgpu_display.c +++ b/drivers/gpu/drm/virtio/virtgpu_display.c @@ -243,12 +243,8 @@ static enum drm_connector_status virtio_gpu_conn_detect(
static void virtio_gpu_conn_destroy(struct drm_connector *connector) { - struct virtio_gpu_output *virtio_gpu_output = - drm_connector_to_virtio_gpu_output(connector); - drm_connector_unregister(connector); drm_connector_cleanup(connector); - kfree(virtio_gpu_output); }
static const struct drm_connector_funcs virtio_gpu_connector_funcs = {