⬢ DragonFlyBSD Kernel Audit
DF-3755 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
--- a/sys/dev/drm/radeon/ni_dpm.c
+++ b/sys/dev/drm/radeon/ni_dpm.c
@@ -4019,7 +4019,14 @@ static int ni_parse_power_table(struct radeon_device *rdev)
 			u8 *idx;
 			ps = kzalloc(sizeof(struct ni_ps), GFP_KERNEL);
 			if (ps == NULL) {
+				while (i > 0) {
+					i--;
+					kfree(rdev->pm.dpm.ps[i].ps_priv);
+				}
 				kfree(rdev->pm.dpm.ps);
+				rdev->pm.dpm.ps = NULL;
+				rdev->pm.dpm.boot_ps = NULL;
+				rdev->pm.dpm.uvd_ps = NULL;
 				return -ENOMEM;
 			}
 			rdev->pm.dpm.ps[i].ps_priv = ps;
@@ -4267,13 +4274,17 @@ void ni_dpm_fini(struct radeon_device *rdev)
 {
 	int i;
 
-	for (i = 0; i < rdev->pm.dpm.num_ps; i++) {
-		kfree(rdev->pm.dpm.ps[i].ps_priv);
-	}
-	kfree(rdev->pm.dpm.ps);
+	if (rdev->pm.dpm.ps) {
+		for (i = 0; i < rdev->pm.dpm.num_ps; i++) {
+			kfree(rdev->pm.dpm.ps[i].ps_priv);
+		}
+		kfree(rdev->pm.dpm.ps);
+		rdev->pm.dpm.ps = NULL;
+		rdev->pm.dpm.num_ps = 0;
+	}
 	kfree(rdev->pm.dpm.priv);
 	kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries);
 	r600_free_extended_power_table(rdev);
 }
 
 void ni_dpm_print_power_state(struct radeon_device *rdev,