Similar to commit<789d4c300e10>("drm/msm: don't deref error pointer in the msm_fbdev_create error path"), the error pointer returned by omap_framebuffer_init() gets passed to drm_framebuffer_remove. The latter handles only Null pointers,thus a nasty crash will occur. Drop the unnecessary checks in label fail.

Signed-off-by: Defang Bo bodefang@126.com --- drivers/gpu/drm/omapdrm/omap_fbdev.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/omapdrm/omap_fbdev.c b/drivers/gpu/drm/omapdrm/omap_fbdev.c index 3f6cfc2..7ba07c8 100644 --- a/drivers/gpu/drm/omapdrm/omap_fbdev.c +++ b/drivers/gpu/drm/omapdrm/omap_fbdev.c @@ -141,8 +141,7 @@ static int omap_fbdev_create(struct drm_fb_helper *helper, * to unref the bo: */ drm_gem_object_put(fbdev->bo); - ret = PTR_ERR(fb); - goto fail; + return PTR_ERR(fb); }

/* note: this keeps the bo pinned.. which is perhaps not ideal, @@ -199,12 +198,7 @@ static int omap_fbdev_create(struct drm_fb_helper *helper, return 0;

fail: - - if (ret) { - if (fb) - drm_framebuffer_remove(fb); - } - + drm_framebuffer_remove(fb); return ret; }