drm: use after free in drm_queue_vblank_event()

The "e" pointer is either NULL or freed when we call
drm_vblank_put(dev, e->pipe) on the error path.  Just pass the "pipe"
variable directly instead.

I changed another caller to use "pipe" as well for consistency.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 722700d5d73ee69a6ac49d4fbd96d307f704c2bb..16d5155edad14fd63dea3b10243a71c6bd3d0ea1 100644 (file)
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -628,7 +628,7 @@ static int drm_queue_vblank_event(struct drm_device *dev, int pipe,
        if ((seq - vblwait->request.sequence) <= (1 << 23)) {
                e->event.tv_sec = now.tv_sec;
                e->event.tv_usec = now.tv_usec;
-               drm_vblank_put(dev, e->pipe);
+               drm_vblank_put(dev, pipe);
                list_add_tail(&e->base.link, &e->base.file_priv->event_list);
                wake_up_interruptible(&e->base.file_priv->event_wait);
                trace_drm_vblank_event_delivered(current->pid, pipe,
@@ -645,7 +645,7 @@ err_unlock:
        spin_unlock_irqrestore(&dev->event_lock, flags);
        kfree(e);
 err_put:
-       drm_vblank_put(dev, e->pipe);
+       drm_vblank_put(dev, pipe);
        return ret;
 }