Hi Dan,

On Thu, 24 Oct 2019 23:53:06 +0300 Dan Carpenter dan.carpenter@oracle.com wrote:

Originally this error path used to leak "bin" but then we accidentally applied two separate commits to fix it and ended up with a double free.

Signed-off-by: Dan Carpenter dan.carpenter@oracle.com

Hi Stephen,

I think this one is actually just a linux-next issue and the Fixes tag would point to commit f8593384f83f ("Merge remote-tracking branch 'drm/drm-next'").

The original commits are 0d352a3a8a1f ("drm/v3d: don't leak bin job if v3d_job_init fails.") and commit 29cd13cfd762 ("drm/v3d: Fix memory leak in v3d_submit_cl_ioctl").

I'm not totally sure how you guys address this normally but presumably you are experts at dealing with merge issues. :)

drivers/gpu/drm/v3d/v3d_gem.c | 1 - 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c index 549dde83408b..37515e47b47e 100644 --- a/drivers/gpu/drm/v3d/v3d_gem.c +++ b/drivers/gpu/drm/v3d/v3d_gem.c @@ -568,7 +568,6 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data, ret = v3d_job_init(v3d, file_priv, &bin->base, v3d_job_free, args->in_sync_bcl); if (ret) {

• 	kfree(bin);
  v3d_job_put(&render->base);
  kfree(bin);
  return ret;
  

I will just apply this as part of the drm tree merge until Dave merges the drm-misc-fixes tree and fixes this up.

Originally this error path used to leak "bin" but then we accidentally applied two separate commits to fix it and ended up with a double free.

Signed-off-by: Dan Carpenter dan.carpenter@oracle.com --- Resending a year later because it was confusing at the time who should apply this and it fell through the cracks. For some reason the kbuild bot flagged it as a new warning so it showed up on my radar again.

drivers/gpu/drm/v3d/v3d_gem.c | 1 - 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c index 549dde83408b..37515e47b47e 100644 --- a/drivers/gpu/drm/v3d/v3d_gem.c +++ b/drivers/gpu/drm/v3d/v3d_gem.c @@ -568,7 +568,6 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data, ret = v3d_job_init(v3d, file_priv, &bin->base, v3d_job_free, args->in_sync_bcl); if (ret) { - kfree(bin); v3d_job_put(&render->base); kfree(bin); return ret;