github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-10 17:11:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

staging: media: tegra-video: fix syncpoint leak in tegra20 channel init

Browse Source 
tegra20_channel_host1x_syncpt_init() requests two host1x syncpoints. It
stored the first one (mw ack) into chan->mw_ack_sp[0] and only then
requested the second one (frame start). If the second request failed the
function returned without releasing the first syncpoint, leaking it: the
caller tegra_channel_init() bails out with a bare "return ret" on a
syncpt init failure and does not run its free_syncpts error path (that
path only covers failures after syncpoint init has fully succeeded), and
the channel is subsequently torn down via the kfree()-only path, so
nothing ever releases the orphaned syncpoint.

Release the already-acquired syncpoint on the error path, and only
publish the syncpoints into the channel once both have been successfully
requested, so chan->mw_ack_sp[0] never holds a released handle. This
matches the handling in tegra210_channel_host1x_syncpt_init().

Fixes: 0e2c4117c3 ("staging: media: tegra-video: add CSI support for Tegra20 and Tegra30")
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
Reviewed-by: Svyatoslav Ryhel <clamor95@gmail.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
This commit is contained in:
Cong Nguyen 2026-07-26 17:04:08 +07:00 committed by Hans Verkuil
parent 9cfc1aca07
commit db75789350
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/staging/media/tegra-video/tegra20.c
View File

@ -429,12 +429,13 @@ static int tegra20_channel_host1x_syncpt_init(struct tegra_vi_channel *chan)
if (!out_sp)
return dev_err_probe(vi->dev, -EBUSY, "failed to request mw ack syncpoint\n");
chan->mw_ack_sp[0] = out_sp;
fs_sp = host1x_syncpt_request(&vi->client, HOST1X_SYNCPT_CLIENT_MANAGED);
if (!fs_sp)
if (!fs_sp) {
host1x_syncpt_put(out_sp);
return dev_err_probe(vi->dev, -EBUSY, "failed to request frame start syncpoint\n");
}
chan->mw_ack_sp[0] = out_sp;
chan->frame_start_sp[0] = fs_sp;
return 0;