diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2019-09-18 16:14:15 +0100 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2019-09-19 08:16:14 +0100 |
| commit | 77c53210779c30cfb8a4ca2312675fe5be94f4d5 (patch) | |
| tree | a6fecabdd442c3ee47980b7c4e32defde9ae85ea /tests/kms_dp_tiled_display.c | |
| parent | 63e30122cadaf2798ae2bd44a56cee81a27fbc40 (diff) | |
kms_dp_tiled_display: Fix the double free of drmConnector
drmModeFreeConnector is called inside the loop and after. Not
unsurprisingly this leads to a use-after-free and memcorruption.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111710
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Manasi Navare <manasi.d.navare@intel.com>
Reviewed-by: Manasi Navare <manasi.d.navare@intel.com>
Diffstat (limited to 'tests/kms_dp_tiled_display.c')
| -rw-r--r-- | tests/kms_dp_tiled_display.c | 28 |
1 files changed, 10 insertions, 18 deletions
diff --git a/tests/kms_dp_tiled_display.c b/tests/kms_dp_tiled_display.c index c4643c35..dc4866d2 100644 --- a/tests/kms_dp_tiled_display.c +++ b/tests/kms_dp_tiled_display.c @@ -100,37 +100,29 @@ cleanup: static void get_number_of_h_tiles(data_t *data) { - int i; + igt_tile_info_t tile = {}; drmModeResPtr res; - drmModeConnectorPtr connector; - igt_tile_info_t tile = {.num_h_tile = 0}; igt_assert(res = drmModeGetResources(data->drm_fd)); - for (i = 0; i < res->count_connectors; i++) { + for (int i = 0; !data->num_h_tiles && i < res->count_connectors; i++) { + drmModeConnectorPtr connector; + connector = drmModeGetConnectorCurrent(data->drm_fd, res->connectors[i]); - igt_assert(connector); - if (connector->connection != DRM_MODE_CONNECTED || - connector->connector_type != DRM_MODE_CONNECTOR_DisplayPort) { - drmModeFreeConnector(connector); - continue; - } - - get_connector_tile_props(data, connector, &tile); + if (connector->connection == DRM_MODE_CONNECTED && + connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort) { + get_connector_tile_props(data, connector, &tile); - if (tile.num_h_tile == 0) { - drmModeFreeConnector(connector); - continue; + data->num_h_tiles = tile.num_h_tile; } - data->num_h_tiles = tile.num_h_tile; - break; + + drmModeFreeConnector(connector); } drmModeFreeResources(res); - drmModeFreeConnector(connector); } static void get_connectors(data_t *data) |