Messages in this thread | | | Subject | Re: [PATCH] drm: Fix possible memleak in drm_client_modeset_probe | From | He Ying <> | Date | Tue, 9 Nov 2021 10:06:40 +0800 |
| |
kindly ping...
在 2021/10/22 9:26, He Ying 写道: > I got memory leak as follows when doing fault injection test: > > WARNING: CPU: 0 PID: 1214 at drm_mode_config_cleanup+0x689/0x890 [drm] > RIP: 0010:drm_mode_config_cleanup+0x689/0x890 [drm] > Call Trace: > ? tracer_hardirqs_on+0x33/0x520 > ? drm_mode_config_reset+0x3f0/0x3f0 [drm] > ? trace_event_raw_event_rcu_torture_read+0x2c0/0x2c0 > ? __sanitizer_cov_trace_pc+0x1d/0x50 > ? call_rcu+0x489/0x15e0 > ? trace_hardirqs_on+0x63/0x2d0 > ? write_comp_data+0x2a/0x90 > ? drm_mode_config_cleanup+0x890/0x890 [drm] > drm_managed_release+0x1fa/0x4f0 [drm] > drm_dev_release+0x72/0xb0 [drm] > devm_drm_dev_init_release+0x81/0xa0 [drm] > release_nodes+0xba/0x3b0 > ... > entry_SYSCALL_64_after_hwframe+0x44/0xae > > and then an error message: > > [drm:drm_mode_config_cleanup [drm]] *ERROR* connector SPI-1 leaked! > > When krealloc() in drm_client_modeset_probe() fails, it > goes to the label 'free_connectors'. However, krealloc() > is between drm_connector_list_iter_begin() and *_end(). > Going to the label directly is not a good idea. Because > iter->conn is not cleaned up if so. Fix the problem by > going to the label outside drm_connector_list_iter_end(). > > Signed-off-by: He Ying <heying24@huawei.com> > --- > drivers/gpu/drm/drm_client_modeset.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c > index ced09c7c06f9..7ac88ae93f38 100644 > --- a/drivers/gpu/drm/drm_client_modeset.c > +++ b/drivers/gpu/drm/drm_client_modeset.c > @@ -789,7 +789,7 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width, > tmp = krealloc(connectors, (connector_count + 1) * sizeof(*connectors), GFP_KERNEL); > if (!tmp) { > ret = -ENOMEM; > - goto free_connectors; > + break; > } > > connectors = tmp; > @@ -798,6 +798,9 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width, > } > drm_connector_list_iter_end(&conn_iter); > > + if (ret) > + goto free_connectors; > + > if (!connector_count) > return 0; >
| |