Commit cce30b83 authored by Chaitanya Kumar Borah's avatar Chaitanya Kumar Borah Committed by Maarten Lankhorst
Browse files

drm/vkms: Fix color pipeline enum name leak 



vkms_initialize_colorops() allocates enum names for color pipelines,
which are copied by drm_property_create_enum(). The temporary strings
were not freed, resulting in a memory leak.

Allocate enum names only after successful pipeline construction and
free them on all exit paths

Fixes: c1e578bd ("drm/vkms: Add enumerated 1D curve colorop")
Signed-off-by: default avatarChaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
Reviewed-by: default avatarUma Shankar <uma.shankar@intel.com>
Reviewed-by: default avatarAlex Hung <alex.hung@amd.com>
Reviewed-by: default avatarLouis Chauvet <louis.chauvet@bootlin.com>
Signed-off-by: default avatarMaarten Lankhorst <dev@lankhorst.se>
Link: https://patch.msgid.link/20260113102303.724205-4-chaitanya.kumar.borah@intel.com
parent 7d8257fe

drivers/gpu/drm/vkms/vkms_colorop.c

+8 −7
Original line number Diff line number Diff line
@@ -37,7 +37,6 @@ static int vkms_initialize_color_pipeline(struct drm_plane *plane, struct drm_pr 
		goto cleanup;



	list->type = ops[i]->base.id;

	list->name = kasprintf(GFP_KERNEL, "Color Pipeline %d", ops[i]->base.id);



	i++;
@@ -88,6 +87,8 @@ static int vkms_initialize_color_pipeline(struct drm_plane *plane, struct drm_pr 


	drm_colorop_set_next_property(ops[i - 1], ops[i]);



	list->name = kasprintf(GFP_KERNEL, "Color Pipeline %d", ops[0]->base.id);



	return 0;



cleanup:
@@ -103,18 +104,18 @@ static int vkms_initialize_color_pipeline(struct drm_plane *plane, struct drm_pr 


int vkms_initialize_colorops(struct drm_plane *plane)

{

	struct drm_prop_enum_list pipeline;

	int ret;

	struct drm_prop_enum_list pipeline = {};

	int ret = 0;



	/* Add color pipeline */

	ret = vkms_initialize_color_pipeline(plane, &pipeline);

	if (ret)

		return ret;

		goto out;



	/* Create COLOR_PIPELINE property and attach */

	ret = drm_plane_create_color_pipeline_property(plane, &pipeline, 1);

	if (ret)

		return ret;



	return 0;

	kfree(pipeline.name);

out:

	return ret;

}