| Message ID | 20220509054441.17282-1-hbh25y@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | gpu: drm: fix possible memory leak in drm_addmap_core() | expand |
On 2022/5/9 13:44, Hangyu Hua wrote: > map->handle need to be handled correctly when map->type is _DRM_SHM or > _DRM_CONSISTENT just like map->type is _DRM_REGISTERS. > > Fixes: 8d153f7107ff ("drm: update user token hashing and map handles") > Signed-off-by: Hangyu Hua <hbh25y@gmail.com> > --- > drivers/gpu/drm/drm_bufs.c | 18 ++++++++++++++++++ > 1 file changed, 18 insertions(+) > > diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c > index fcca21e8efac..2b3f504c5f9c 100644 > --- a/drivers/gpu/drm/drm_bufs.c > +++ b/drivers/gpu/drm/drm_bufs.c > @@ -344,6 +344,15 @@ static int drm_addmap_core(struct drm_device *dev, resource_size_t offset, > if (!list) { > if (map->type == _DRM_REGISTERS) > iounmap(map->handle); > + else if (map->type == _DRM_SHM) { > + dev->sigdata.lock = dev->master->lock.hw_lock = NULL; > + vfree(map->handle); > + } else if (map->type == _DRM_CONSISTENT) { > + dma_free_coherent(dev->dev, > + map->size, > + map->handle, > + map->offset); > + } > kfree(map); > return -EINVAL; > } > @@ -361,6 +370,15 @@ static int drm_addmap_core(struct drm_device *dev, resource_size_t offset, > if (ret) { > if (map->type == _DRM_REGISTERS) > iounmap(map->handle); > + else if (map->type == _DRM_SHM) { > + dev->sigdata.lock = dev->master->lock.hw_lock = NULL; > + vfree(map->handle); > + } else if (map->type == _DRM_CONSISTENT) { > + dma_free_coherent(dev->dev, > + map->size, > + map->handle, > + map->offset); > + } > kfree(map); > kfree(list); > mutex_unlock(&dev->struct_mutex); Gentel ping.
On 2022/5/23 09:57, Hangyu Hua wrote: > On 2022/5/9 13:44, Hangyu Hua wrote: >> map->handle need to be handled correctly when map->type is _DRM_SHM or >> _DRM_CONSISTENT just like map->type is _DRM_REGISTERS. >> >> Fixes: 8d153f7107ff ("drm: update user token hashing and map handles") >> Signed-off-by: Hangyu Hua <hbh25y@gmail.com> >> --- >> drivers/gpu/drm/drm_bufs.c | 18 ++++++++++++++++++ >> 1 file changed, 18 insertions(+) >> >> diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c >> index fcca21e8efac..2b3f504c5f9c 100644 >> --- a/drivers/gpu/drm/drm_bufs.c >> +++ b/drivers/gpu/drm/drm_bufs.c >> @@ -344,6 +344,15 @@ static int drm_addmap_core(struct drm_device >> *dev, resource_size_t offset, >> if (!list) { >> if (map->type == _DRM_REGISTERS) >> iounmap(map->handle); >> + else if (map->type == _DRM_SHM) { >> + dev->sigdata.lock = dev->master->lock.hw_lock = NULL; >> + vfree(map->handle); >> + } else if (map->type == _DRM_CONSISTENT) { >> + dma_free_coherent(dev->dev, >> + map->size, >> + map->handle, >> + map->offset); >> + } >> kfree(map); >> return -EINVAL; >> } >> @@ -361,6 +370,15 @@ static int drm_addmap_core(struct drm_device >> *dev, resource_size_t offset, >> if (ret) { >> if (map->type == _DRM_REGISTERS) >> iounmap(map->handle); >> + else if (map->type == _DRM_SHM) { >> + dev->sigdata.lock = dev->master->lock.hw_lock = NULL; >> + vfree(map->handle); >> + } else if (map->type == _DRM_CONSISTENT) { >> + dma_free_coherent(dev->dev, >> + map->size, >> + map->handle, >> + map->offset); >> + } >> kfree(map); >> kfree(list); >> mutex_unlock(&dev->struct_mutex); > > Gentel ping. Gentel ping.
diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c index fcca21e8efac..2b3f504c5f9c 100644 --- a/drivers/gpu/drm/drm_bufs.c +++ b/drivers/gpu/drm/drm_bufs.c @@ -344,6 +344,15 @@ static int drm_addmap_core(struct drm_device *dev, resource_size_t offset, if (!list) { if (map->type == _DRM_REGISTERS) iounmap(map->handle); + else if (map->type == _DRM_SHM) { + dev->sigdata.lock = dev->master->lock.hw_lock = NULL; + vfree(map->handle); + } else if (map->type == _DRM_CONSISTENT) { + dma_free_coherent(dev->dev, + map->size, + map->handle, + map->offset); + } kfree(map); return -EINVAL; } @@ -361,6 +370,15 @@ static int drm_addmap_core(struct drm_device *dev, resource_size_t offset, if (ret) { if (map->type == _DRM_REGISTERS) iounmap(map->handle); + else if (map->type == _DRM_SHM) { + dev->sigdata.lock = dev->master->lock.hw_lock = NULL; + vfree(map->handle); + } else if (map->type == _DRM_CONSISTENT) { + dma_free_coherent(dev->dev, + map->size, + map->handle, + map->offset); + } kfree(map); kfree(list); mutex_unlock(&dev->struct_mutex);
map->handle need to be handled correctly when map->type is _DRM_SHM or _DRM_CONSISTENT just like map->type is _DRM_REGISTERS. Fixes: 8d153f7107ff ("drm: update user token hashing and map handles") Signed-off-by: Hangyu Hua <hbh25y@gmail.com> --- drivers/gpu/drm/drm_bufs.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)