On Mon, Jul 4, 2016 at 4:19 PM, weiyj_lk@163.com wrote:

From: Wei Yongjun yongjun_wei@trendmicro.com.cn

data allocated with devm_kzalloc should not be freed using kfree, because doing so causes a dangling pointer, and a subsequent double free, use devm_kfree instead.

Signed-off-by: Wei Yongjun yongjun_wei@trendmicro.com.cn

drivers/gpu/drm/tegra/sor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c index 8425eda..af98587 100644 --- a/drivers/gpu/drm/tegra/sor.c +++ b/drivers/gpu/drm/tegra/sor.c @@ -363,7 +363,7 @@ static struct clk *tegra_clk_sor_brick_register(struct tegra_sor *sor,

    clk = devm_clk_register(sor->dev, &brick->hw);
    if (IS_ERR(clk))

•           kfree(brick);
  

•           devm_kfree(sor->dev, brick);
  
    return clk;
  

}

Dan sent another fix for this:

https://lkml.org/lkml/2016/7/4/83

I tend to prefer his solution since it has a negative line count and also doesn't do the (unneeded) explicit devm_kfree().

Thanks though! Alex.