Commit d0b1d259 authored by Christophe JAILLET's avatar Christophe JAILLET Committed by Eric Anholt

drm/vc4: Fix resource leak in 'vc4_get_hang_state_ioctl()' in error handling path

If one 'drm_gem_handle_create()' fails, we leak somes handles and some
memory.

In order to fix it:
  - move the 'free(bo_state)' at the end of the function so that it is also
    called in the eror handling path. This has the side effect to also try
    to free it if the first 'kcalloc' fails. This is harmless.
  - add a new label, err_delete_handle, in order to delete already
    allocated handles in error handling path
  - remove the now useless 'err' label

The way the code is now written will also delete the handles if the
'copy_to_user()' call fails.
Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: default avatarEric Anholt <eric@anholt.net>
Link: http://patchwork.freedesktop.org/patch/msgid/20170512123803.1886-1-christophe.jaillet@wanadoo.fr
parent 24bb206f
...@@ -111,8 +111,8 @@ vc4_get_hang_state_ioctl(struct drm_device *dev, void *data, ...@@ -111,8 +111,8 @@ vc4_get_hang_state_ioctl(struct drm_device *dev, void *data,
&handle); &handle);
if (ret) { if (ret) {
state->bo_count = i - 1; state->bo_count = i;
goto err; goto err_delete_handle;
} }
bo_state[i].handle = handle; bo_state[i].handle = handle;
bo_state[i].paddr = vc4_bo->base.paddr; bo_state[i].paddr = vc4_bo->base.paddr;
...@@ -124,13 +124,16 @@ vc4_get_hang_state_ioctl(struct drm_device *dev, void *data, ...@@ -124,13 +124,16 @@ vc4_get_hang_state_ioctl(struct drm_device *dev, void *data,
state->bo_count * sizeof(*bo_state))) state->bo_count * sizeof(*bo_state)))
ret = -EFAULT; ret = -EFAULT;
kfree(bo_state); err_delete_handle:
if (ret) {
for (i = 0; i < state->bo_count; i++)
drm_gem_handle_delete(file_priv, bo_state[i].handle);
}
err_free: err_free:
vc4_free_hang_state(dev, kernel_state); vc4_free_hang_state(dev, kernel_state);
kfree(bo_state);
err:
return ret; return ret;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment