Skip to content

Commit

Permalink
staging: mmal-vchiq: Fix memory leak in error path
Browse files Browse the repository at this point in the history
On error, vchiq_mmal_component_init could leave the
event context allocated for ports.
Clean them up in the error path.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
  • Loading branch information
6by9 authored and popcornmix committed Oct 17, 2024
1 parent a418da8 commit 8fdb1b4
Showing 1 changed file with 20 additions and 9 deletions.
29 changes: 20 additions & 9 deletions drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
Original file line number Diff line number Diff line change
Expand Up @@ -1766,9 +1766,26 @@ static void free_event_context(struct vchiq_mmal_port *port)
{
struct mmal_msg_context *ctx = port->event_context;

if (!ctx)
return;

kfree(ctx->u.bulk.buffer->buffer);
kfree(ctx->u.bulk.buffer);
release_msg_context(ctx);
port->event_context = NULL;
}

static void release_all_event_contexts(struct vchiq_mmal_component *component)
{
int idx;

for (idx = 0; idx < component->inputs; idx++)
free_event_context(&component->input[idx]);
for (idx = 0; idx < component->outputs; idx++)
free_event_context(&component->output[idx]);
for (idx = 0; idx < component->clocks; idx++)
free_event_context(&component->clock[idx]);
free_event_context(&component->control);
}

/* Initialise a mmal component and its ports
Expand Down Expand Up @@ -1866,6 +1883,7 @@ int vchiq_mmal_component_init(struct vchiq_mmal_instance *instance,

release_component:
destroy_component(instance, component);
release_all_event_contexts(component);
unlock:
if (component)
component->in_use = false;
Expand All @@ -1881,7 +1899,7 @@ EXPORT_SYMBOL_GPL(vchiq_mmal_component_init);
int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,
struct vchiq_mmal_component *component)
{
int ret, idx;
int ret;

if (mutex_lock_interruptible(&instance->vchiq_mutex))
return -EINTR;
Expand All @@ -1893,14 +1911,7 @@ int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,

component->in_use = false;

for (idx = 0; idx < component->inputs; idx++)
free_event_context(&component->input[idx]);
for (idx = 0; idx < component->outputs; idx++)
free_event_context(&component->output[idx]);
for (idx = 0; idx < component->clocks; idx++)
free_event_context(&component->clock[idx]);

free_event_context(&component->control);
release_all_event_contexts(component);

mutex_unlock(&instance->vchiq_mutex);

Expand Down

0 comments on commit 8fdb1b4

Please sign in to comment.