In drm_universal_plane_init(), if 'format_count' is larger than 64, no
cleanup is executed, leading to memory/resource leaks. To fix this issue,
perform cleanup work before returning -EINVAL.
Signed-off-by: Wenwen Wang <wenwen@xxxxxxxxxx>
---
drivers/gpu/drm/drm_plane.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index d6ad60a..2c0d0044 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -211,8 +211,11 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
* First driver to need more than 64 formats needs to fix this. Each
* format is encoded as a bit and the current code only supports a u64.
*/
- if (WARN_ON(format_count > 64))
+ if (WARN_ON(format_count > 64)) {
+ kfree(plane->format_types);
+ drm_mode_object_unregister(dev, &plane->base);
return -EINVAL;
+ }
if (format_modifiers) {
const uint64_t *temp_modifiers = format_modifiers;
--
2.7.4
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/dri-devel
