From 3a29ace8e0a8bfa72d318f66dbe11af1ffef0c2c Mon Sep 17 00:00:00 2001 From: ngie Date: Fri, 13 May 2016 08:39:33 +0000 Subject: [PATCH] MFC r298334: r298334 (by cem): drm2(4): Fix double-free in low-memory error path Reallocf frees 'block'; don't attempt to free it again. CID: 1091165 git-svn-id: svn://svn.freebsd.org/base/stable/10@299622 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sys/dev/drm2/drm_edid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sys/dev/drm2/drm_edid.c b/sys/dev/drm2/drm_edid.c index 6fad73620..9ff4ee1d1 100644 --- a/sys/dev/drm2/drm_edid.c +++ b/sys/dev/drm2/drm_edid.c @@ -353,8 +353,10 @@ drm_do_get_edid(struct drm_connector *connector, device_t adapter) new = reallocf(block, (block[0x7e] + 1) * EDID_LENGTH, DRM_MEM_KMS, M_NOWAIT); - if (!new) + if (!new) { + block = NULL; goto out; + } block = new; for (j = 1; j <= block[0x7e]; j++) { -- 2.45.0