Re: [PATCH] drm/vmwgfx: Fix double free in vmw_recv_msg()

2019-09-05 Thread Thomas Hellstrom
On Thu, 2019-08-15 at 09:38 +0100, Colin Ian King wrote: > On 15/08/2019 09:30, Dan Carpenter wrote: > > We recently added a kfree() after the end of the loop: > > > > if (retries == RETRIES) { > > kfree(reply); > > return -EINVAL; > > } > > > > There are two

Re: [PATCH] drm/vmwgfx: Fix double free in vmw_recv_msg()

2019-08-15 Thread Colin Ian King
On 15/08/2019 09:30, Dan Carpenter wrote: > We recently added a kfree() after the end of the loop: > > if (retries == RETRIES) { > kfree(reply); > return -EINVAL; > } > > There are two problems. First the test is wrong and because retries > equals RETRIES

[PATCH] drm/vmwgfx: Fix double free in vmw_recv_msg()

2019-08-15 Thread Dan Carpenter
We recently added a kfree() after the end of the loop: if (retries == RETRIES) { kfree(reply); return -EINVAL; } There are two problems. First the test is wrong and because retries equals RETRIES if we succeed on the last iteration through the