diff options
| author | Ameer Hamza <amhamza.mgc@gmail.com> | 2021-12-06 11:43:15 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-12-14 19:51:47 +0100 |
| commit | 5cedfe8aaf1875a5305897107b7f298db4260019 (patch) | |
| tree | d46b7ae96834ebebb5facba8d4b327a7fa2b9ac6 | |
| parent | d3717cf6baa41ea6f784d130a6b7d80c19d62099 (diff) | |
| download | linux-5cedfe8aaf1875a5305897107b7f298db4260019.tar.gz linux-5cedfe8aaf1875a5305897107b7f298db4260019.tar.bz2 linux-5cedfe8aaf1875a5305897107b7f298db4260019.zip | |
media: venus: vdec: fixed possible memory leak issue
commit 8403fdd775858a7bf04868d43daea0acbe49ddfc upstream.
The venus_helper_alloc_dpb_bufs() implementation allows an early return
on an error path when checking the id from ida_alloc_min() which would
not release the earlier buffer allocation.
Move the direct kfree() from the error checking of dma_alloc_attrs() to
the common fail path to ensure that allocations are released on all
error paths in this function.
Addresses-Coverity: 1494120 ("Resource leak")
cc: stable@vger.kernel.org # 5.16+
Fixes: 40d87aafee29 ("media: venus: vdec: decoded picture buffer handling during reconfig sequence")
Signed-off-by: Ameer Hamza <amhamza.mgc@gmail.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/media/platform/qcom/venus/helpers.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c index 9d43d4dbfc60..90e3c950deb1 100644 --- a/drivers/media/platform/qcom/venus/helpers.c +++ b/drivers/media/platform/qcom/venus/helpers.c @@ -189,7 +189,6 @@ int venus_helper_alloc_dpb_bufs(struct venus_inst *inst) buf->va = dma_alloc_attrs(dev, buf->size, &buf->da, GFP_KERNEL, buf->attrs); if (!buf->va) { - kfree(buf); ret = -ENOMEM; goto fail; } @@ -209,6 +208,7 @@ int venus_helper_alloc_dpb_bufs(struct venus_inst *inst) return 0; fail: + kfree(buf); venus_helper_free_dpb_bufs(inst); return ret; } |