From:   Bernard Zhao <bernard@vivo.com>
To:     Maarten Lankhorst <maarten.lankhorst@linux.intel.com>,
        Maxime Ripard <mripard@kernel.org>,
        Thomas Zimmermann <tzimmermann@suse.de>,
        David Airlie <airlied@linux.ie>,
        Daniel Vetter <daniel@ffwll.ch>,
        dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Cc:     Bernard Zhao <bernard@vivo.com>
Subject: [PATCH v2] gpu/drm: fix potential memleak in error branch
Date:   Wed,  5 Jan 2022 04:13:25 -0800
Message-Id: <20220105121325.15188-1-bernard@vivo.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?ch3o2rJro/+SfCCwfyytxYmP8zGPquKJRFHMeo+oi6tyPNRHRRth2h8KISe2?=
 =?us-ascii?Q?rK+XMPFIYssaMRW4kMqibGtMND7K5MEJaOkalsaKhbmQGo5nRuvRTIqBh4ya?=
 =?us-ascii?Q?dkoxaKDE1Xs3/AdmkWkvo8XOnYlj8tKvaOD3fbSWPG018N1eYGfAI+L3VWPZ?=
 =?us-ascii?Q?6LMJx3PdLghUMoSgEgQoXu7mbxPJK402zOUjtHR0roWq31LwfNoMZ64v7dJh?=
 =?us-ascii?Q?bmNDb9BTfVlosxO6YMKWxr+Recp6tvTkgEU8UfJc/e7f4r7zvsdCh5Y8jMGX?=
 =?us-ascii?Q?vR+dq3axvsycydmVwvP0S6AawORvXaLhTbQlah5XtID8/Grra4UhxVqSA0K3?=
 =?us-ascii?Q?QDzWxbjxz7dp+3WMIh87WGE0NCeCuJkPGz22lIMR8jXv1MZ3ZNkFWFHba8c7?=
 =?us-ascii?Q?xvftpnKSvFH+57krKrhfyTgG7BoTmX6GuakO68SACp8+Nf++nyHUbMCdGro+?=
 =?us-ascii?Q?Qnmhqy1ypE2xUrSCzRoKTTWLaIZA+4VmuPs2+9oqHWLf5s9VzVL8ctHv9UNX?=
 =?us-ascii?Q?W0JyDrN0Aydlh5SjjUsJFB9PvhHodLLmaUhtdmsMMqVz1ewhcTcJlDlbAccP?=
 =?us-ascii?Q?cefzyRF713xf+MpzrFVFnkLdAnpVXhapN35wAbkTzCVIWZxdFsh2f1ouylyR?=
 =?us-ascii?Q?L+3RnitDSq8K63kNEfUsIZKGAA2cHqqQt0qtZAHZyYghDrppqsgTHMSxEc8G?=
 =?us-ascii?Q?dCzCvyFhRBcaHx3cvFlkM6mYxEAex5yA2JGwWnhGrNd/pmMncMgdVwAxbU6M?=
 =?us-ascii?Q?54iRlbqFaftZ5QUJAe/+RmSkwklH/wztMZphSqOJyAwyxD6op008B2hvc3GB?=
 =?us-ascii?Q?vGgdvTV5ResMlNd5dznpObA+3/TyJ/JncE8KCXlnzdAAW2jlP6qQu0TKVqZT?=
 =?us-ascii?Q?UegKtot8JIXcLYjrtC+6ozIE8M4Yl/OxT0dqsn19zp0eZMHoaBCqMKcOYv3o?=
 =?us-ascii?Q?6bYo/A5RmFewF2xNBfytFG3quZjD7RZOgTUC9eiE+2L3xeOUJvu8+fhbbMf2?=
 =?us-ascii?Q?D5H/eyYI9kMt/EL+wcmHnxEOxol+u/sV+QNKz+1cNALd5QDL+a0bc63pPTCY?=
 =?us-ascii?Q?h1S36vCRBGWMcKV6QgrbGYVm4xnexdmkslxBZTdhm6zVCjo0t1CBgNr8G10h?=
 =?us-ascii?Q?sJiULFJnW/854LZPbnfSyK5oQNGLSFmRPvBRGv8Ki4eL/KOwYwOMy+g/fcq2?=
 =?us-ascii?Q?tkcBntPw8+EpiFpjBNHbC65lCtnewaNxPLDYa3/gaMxCmIpF16ET+YGguKBk?=
 =?us-ascii?Q?P/1ZeOWXvjqhC7W75ld+1pyGv2pbH261NKqXMMNYI61fA9UUd7VvCzrhe/Dh?=
 =?us-ascii?Q?3jNABeqRHrJYos/twSHcgiSaEvZaKPmEj43OVvAptWZrcJdMni8MvIUI9OGh?=
 =?us-ascii?Q?lovd35O/O8ucdh92k0KI35Rwx1QBMTustbz/ZNDybNHWLcTA+YYjl9LhBy7u?=
 =?us-ascii?Q?FE/K/BojKeU/hT+rvBGfcZtokTupnjpnGOPugEpS6tFudZVUNUO47NSrDSoY?=
 =?us-ascii?Q?jA8R2psVG363gDZjA2Z9f8a/ICbH6SMFbp5SswXUmPc5EOxhzevIxOGlAueh?=
 =?us-ascii?Q?1B0jIpd5Pf5F+C7T5isoOgluXegQfVTJEBf57yfGlew2mMWrjAp8cWjHSLMd?=
 =?us-ascii?Q?EVQioBcFWtR1+9ft4AIVmcI=3D?=
X-OriginatorOrg: vivo.com
X-MS-Exchange-CrossTenant-Network-Message-Id: eb7b8b29-31e0-42f6-5b0d-08d9d044ce76
X-MS-Exchange-CrossTenant-AuthSource: PSAPR06MB4021.apcprd06.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Jan 2022 12:13:39.2664
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 923e42dc-48d5-4cbe-b582-1a797a6412ed
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: XMn194agimTTnZj3H/8b3mMmOtxywq0MTAycdMtNmVG1887KcgORkbk2kpfDw/Pl5/sNe4d73ujlKjPtWWKl1w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PS2PR06MB3608
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

This patch try to fix potential memleak in error branch.
For example:
nv50_sor_create ->nv50_mstm_new-> drm_dp_mst_topology_mgr_init,
In function drm_dp_mst_topology_mgr_init, there are five error
branches, error branch just return error code, no free called.
And we see that the caller didn`t do the drm_dp_mst_topology_mgr_destroy job.
In this case, this may bring in the risk of memleak issue.

Signed-off-by: Bernard Zhao <bernard@vivo.com>
---
 drivers/gpu/drm/drm_dp_mst_topology.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index f3d79eda94bb..f73b180dee73 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -5501,7 +5501,10 @@ int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr,
 				 int max_lane_count, int max_link_rate,
 				 int conn_base_id)
 {
-	struct drm_dp_mst_topology_state *mst_state;
+	struct drm_dp_mst_topology_state *mst_state = NULL;
+
+	mgr->payloads = NULL;
+	mgr->proposed_vcpis = NULL;
 
 	mutex_init(&mgr->lock);
 	mutex_init(&mgr->qlock);
@@ -5523,7 +5526,7 @@ int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr,
 	 */
 	mgr->delayed_destroy_wq = alloc_ordered_workqueue("drm_dp_mst_wq", 0);
 	if (mgr->delayed_destroy_wq == NULL)
-		return -ENOMEM;
+		goto out;
 
 	INIT_WORK(&mgr->work, drm_dp_mst_link_probe_work);
 	INIT_WORK(&mgr->tx_work, drm_dp_tx_work);
@@ -5539,18 +5542,18 @@ int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr,
 	mgr->conn_base_id = conn_base_id;
 	if (max_payloads + 1 > sizeof(mgr->payload_mask) * 8 ||
 	    max_payloads + 1 > sizeof(mgr->vcpi_mask) * 8)
-		return -EINVAL;
+		goto failed;
 	mgr->payloads = kcalloc(max_payloads, sizeof(struct drm_dp_payload), GFP_KERNEL);
 	if (!mgr->payloads)
-		return -ENOMEM;
+		goto failed;
 	mgr->proposed_vcpis = kcalloc(max_payloads, sizeof(struct drm_dp_vcpi *), GFP_KERNEL);
 	if (!mgr->proposed_vcpis)
-		return -ENOMEM;
+		goto failed;
 	set_bit(0, &mgr->payload_mask);
 
 	mst_state = kzalloc(sizeof(*mst_state), GFP_KERNEL);
 	if (mst_state == NULL)
-		return -ENOMEM;
+		goto failed;
 
 	mst_state->total_avail_slots = 63;
 	mst_state->start_slot = 1;
@@ -5563,6 +5566,13 @@ int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr,
 				    &drm_dp_mst_topology_state_funcs);
 
 	return 0;
+
+failed:
+	kfree(mgr->proposed_vcpis);
+	kfree(mgr->payloads);
+	destroy_workqueue(mgr->delayed_destroy_wq);
+out:
+	return -ENOMEM;
 }
 EXPORT_SYMBOL(drm_dp_mst_topology_mgr_init);
 
-- 
2.33.1