Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

drm/i915/display: Fix color pipeline enum name leak

intel_color_pipeline_plane_init() allocates enum names for color
pipelines, which are copied by drm_property_create_enum(). The temporary
strings were not freed, resulting in a memory leak.

Allocate enum names only after successful pipeline construction and free
them on all exit paths.

Fixes: ef105316819d ("drm/i915/color: Create a transfer function color pipeline")
Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
Acked-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patch.msgid.link/20260113102303.724205-5-chaitanya.kumar.borah@intel.com

authored by

Chaitanya Kumar Borah and committed by
Maarten Lankhorst
0a095b64 cce30b83

+13 -5
+13 -5
drivers/gpu/drm/i915/display/intel_color_pipeline.c
··· 34 34 return ret; 35 35 36 36 list->type = colorop->base.base.id; 37 - list->name = kasprintf(GFP_KERNEL, "Color Pipeline %d", colorop->base.base.id); 38 37 39 38 /* TODO: handle failures and clean up */ 40 39 prev_op = &colorop->base; ··· 73 74 74 75 drm_colorop_set_next_property(prev_op, &colorop->base); 75 76 77 + list->name = kasprintf(GFP_KERNEL, "Color Pipeline %d", list->type); 78 + 76 79 return 0; 77 80 } 78 81 ··· 82 81 { 83 82 struct drm_device *dev = plane->dev; 84 83 struct intel_display *display = to_intel_display(dev); 85 - struct drm_prop_enum_list pipelines[MAX_COLOR_PIPELINES]; 84 + struct drm_prop_enum_list pipelines[MAX_COLOR_PIPELINES] = {}; 86 85 int len = 0; 87 - int ret; 86 + int ret = 0; 87 + int i; 88 88 89 89 /* Currently expose pipeline only for HDR planes */ 90 90 if (!icl_is_hdr_plane(display, to_intel_plane(plane)->id)) ··· 94 92 /* Add pipeline consisting of transfer functions */ 95 93 ret = _intel_color_pipeline_plane_init(plane, &pipelines[len], pipe); 96 94 if (ret) 97 - return ret; 95 + goto out; 98 96 len++; 99 97 100 - return drm_plane_create_color_pipeline_property(plane, pipelines, len); 98 + ret = drm_plane_create_color_pipeline_property(plane, pipelines, len); 99 + 100 + for (i = 0; i < len; i++) 101 + kfree(pipelines[i].name); 102 + 103 + out: 104 + return ret; 101 105 }