Commit adb0971a authored by Simona Vetter's avatar Simona Vetter
Browse files

Merge tag 'drm-intel-fixes-2025-10-23' of... 

Merge tag 'drm-intel-fixes-2025-10-23' of https://gitlab.freedesktop.org/drm/i915/kernel

 into drm-fixes

- Fix panic structure allocation memory leak (Jani)

Signed-off-by: default avatarSimona Vetter <simona.vetter@ffwll.ch>
From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://lore.kernel.org/r/aPojgsvNYOU0tN4U@intel.com
parents 0cdf7f6f 789e46fb

drivers/gpu/drm/i915/display/intel_fb.c

+13 −12
Original line number Diff line number Diff line
@@ -2117,6 +2117,7 @@ static void intel_user_framebuffer_destroy(struct drm_framebuffer *fb) 


	intel_frontbuffer_put(intel_fb->frontbuffer);



	kfree(intel_fb->panic);

	kfree(intel_fb);

}
@@ -2215,16 +2216,22 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb, 
	struct intel_display *display = to_intel_display(obj->dev);

	struct drm_framebuffer *fb = &intel_fb->base;

	u32 max_stride;

	int ret = -EINVAL;

	int ret;

	int i;



	intel_fb->panic = intel_panic_alloc();

	if (!intel_fb->panic)

		return -ENOMEM;



	/*

	 * intel_frontbuffer_get() must be done before

	 * intel_fb_bo_framebuffer_init() to avoid set_tiling vs. addfb race.

	 */

	intel_fb->frontbuffer = intel_frontbuffer_get(obj);

	if (!intel_fb->frontbuffer)

		return -ENOMEM;

	if (!intel_fb->frontbuffer) {

		ret = -ENOMEM;

		goto err_free_panic;

	}



	ret = intel_fb_bo_framebuffer_init(fb, obj, mode_cmd);

	if (ret)
@@ -2323,6 +2330,9 @@ int intel_framebuffer_init(struct intel_framebuffer *intel_fb, 
	intel_fb_bo_framebuffer_fini(obj);

err_frontbuffer_put:

	intel_frontbuffer_put(intel_fb->frontbuffer);

err_free_panic:

	kfree(intel_fb->panic);



	return ret;

}
@@ -2349,20 +2359,11 @@ intel_user_framebuffer_create(struct drm_device *dev, 
struct intel_framebuffer *intel_framebuffer_alloc(void)

{

	struct intel_framebuffer *intel_fb;

	struct intel_panic *panic;



	intel_fb = kzalloc(sizeof(*intel_fb), GFP_KERNEL);

	if (!intel_fb)

		return NULL;



	panic = intel_panic_alloc();

	if (!panic) {

		kfree(intel_fb);

		return NULL;

	}



	intel_fb->panic = panic;



	return intel_fb;

}