If krealloc() fails, msm_ioctl_gem_info_set_metadata() returns without
unlocking the GEM object. Fix this by jumping to a new label that
unlocks the GEM object before the buffer is freed. This bug has been
detected by the Clang thread-safety analyzer.
Fixes: 1c8c354098ea ("drm/msm: Add error handling for krealloc in metadata
setup")
Signed-off-by: Bart Van Assche <[email protected]>
---
drivers/gpu/drm/msm/msm_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 5e8f3ce26b32..7ab808322be6 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -571,13 +571,14 @@ static int msm_ioctl_gem_info_set_metadata(struct
drm_gem_object *obj,
krealloc(msm_obj->metadata, metadata_size, GFP_KERNEL);
if (!new_metadata) {
ret = -ENOMEM;
- goto out;
+ goto unlock;
}
msm_obj->metadata = new_metadata;
msm_obj->metadata_size = metadata_size;
memcpy(msm_obj->metadata, buf, metadata_size);
+unlock:
msm_gem_unlock(obj);
out:
