[patch] drm/gma500: double free in psbfb_create()

2015-03-19 Thread Dan Carpenter
The psb_gtt_free_range() frees "backing" so calling it twice is a double free bug. I have fixed this by removing the first call. Fixes: 4d8d096e9ae8 ('gma500: introduce the framebuffer support code') Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/gma500/framebuffer.c

[patch] drm/gma500: double free in psbfb_create()

2015-03-19 Thread Alan Cox
On Thu, 2015-03-19 at 13:17 +0300, Dan Carpenter wrote: > The psb_gtt_free_range() frees "backing" so calling it twice is a double > free bug. I have fixed this by removing the first call. > > Fixes: 4d8d096e9ae8 ('gma500: introduce the framebuffer support code') > Signed-off-by: Dan Carpenter