drm: xilinx: dp: debugfs kernel crash fix

In debugfs kern_buff was freed from current position,
rather it should be freed from start.

Signed-off-by: Tejas Upadhyay <tejasu@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>

diff --git a/drivers/gpu/drm/xilinx/xilinx_drm_dp.c b/drivers/gpu/drm/xilinx/xilinx_drm_dp.c
index 08e34a83e33cd0a1c268a3b88b57645dbd04c197..5355dd69eb128f11552bc48096ba8681600a367b 100644 (file)
--- a/drivers/gpu/drm/xilinx/xilinx_drm_dp.c
+++ b/drivers/gpu/drm/xilinx/xilinx_drm_dp.c
@@ -669,7 +669,7 @@ static ssize_t
 xilinx_dp_debugfs_write(struct file *f, const char __user *buf,
                        size_t size, loff_t *pos)
 {
-       char *kern_buff;
+       char *kern_buff, *kern_buff_start;
        char *dp_test_req;
        int ret;
        int i;
@@ -683,10 +683,11 @@ xilinx_dp_debugfs_write(struct file *f, const char __user *buf,
        kern_buff = kzalloc(size, GFP_KERNEL);
        if (!kern_buff)
                return -ENOMEM;
+       kern_buff_start = kern_buff;
 
        ret = strncpy_from_user(kern_buff, buf, size);
        if (ret < 0) {
-               kfree(kern_buff);
+               kfree(kern_buff_start);
                return ret;
        }
 
@@ -696,12 +697,12 @@ xilinx_dp_debugfs_write(struct file *f, const char __user *buf,
        for (i = 0; i < ARRAY_SIZE(dp_debugfs_reqs); i++) {
                if (!strcasecmp(dp_test_req, dp_debugfs_reqs[i].req))
                        if (!dp_debugfs_reqs[i].write_handler(&kern_buff)) {
-                               kfree(kern_buff);
+                               kfree(kern_buff_start);
                                return size;
                        }
        }
 
-       kfree(kern_buff);
+       kfree(kern_buff_start);
        return -EINVAL;
 }