2022-05-09 10:13:11

by Hangyu Hua

Subject: [PATCH] drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()

drm_gem_object_lookup will call drm_gem_object_get inside. So cursor_bo
needs to be put when msm_gem_get_and_pin_iova fails.

Fixes: e172d10a9c4a ("drm/msm/mdp5: Add hardware cursor support")
Signed-off-by: Hangyu Hua <[email protected]>
---
drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
index b966cd69f99d..6a5f73f6a23b 100644
--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
@@ -991,8 +991,10 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,

ret = msm_gem_get_and_pin_iova(cursor_bo, kms->aspace,
&mdp5_crtc->cursor.iova);
- if (ret)
+ if (ret) {
+ drm_gem_object_put(cursor_bo);
return -EINVAL;
+ }

pm_runtime_get_sync(&pdev->dev);

--
2.25.1

2022-05-23 06:27:55

by Hangyu Hua

Subject: Re: [PATCH] drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()

On 2022/5/9 14:11, Hangyu Hua wrote:
> drm_gem_object_lookup will call drm_gem_object_get inside. So cursor_bo
> needs to be put when msm_gem_get_and_pin_iova fails.
>
> Fixes: e172d10a9c4a ("drm/msm/mdp5: Add hardware cursor support")
> Signed-off-by: Hangyu Hua <[email protected]>
> ---
> drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
> index b966cd69f99d..6a5f73f6a23b 100644
> --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
> +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
> @@ -991,8 +991,10 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
>
> ret = msm_gem_get_and_pin_iova(cursor_bo, kms->aspace,
> &mdp5_crtc->cursor.iova);
> - if (ret)
> + if (ret) {
> + drm_gem_object_put(cursor_bo);
> return -EINVAL;
> + }
>
> pm_runtime_get_sync(&pdev->dev);
>

Gentel ping.