From db757893500d682996f2ee9bd670f30f7fc504af Mon Sep 17 00:00:00 2001 From: Cong Nguyen Date: Sun, 26 Jul 2026 17:04:08 +0700 Subject: [PATCH] staging: media: tegra-video: fix syncpoint leak in tegra20 channel init tegra20_channel_host1x_syncpt_init() requests two host1x syncpoints. It stored the first one (mw ack) into chan->mw_ack_sp[0] and only then requested the second one (frame start). If the second request failed the function returned without releasing the first syncpoint, leaking it: the caller tegra_channel_init() bails out with a bare "return ret" on a syncpt init failure and does not run its free_syncpts error path (that path only covers failures after syncpoint init has fully succeeded), and the channel is subsequently torn down via the kfree()-only path, so nothing ever releases the orphaned syncpoint. Release the already-acquired syncpoint on the error path, and only publish the syncpoints into the channel once both have been successfully requested, so chan->mw_ack_sp[0] never holds a released handle. This matches the handling in tegra210_channel_host1x_syncpt_init(). Fixes: 0e2c4117c351 ("staging: media: tegra-video: add CSI support for Tegra20 and Tegra30") Signed-off-by: Cong Nguyen Reviewed-by: Mikko Perttunen Reviewed-by: Svyatoslav Ryhel Reviewed-by: Luca Ceresoli Signed-off-by: Hans Verkuil --- drivers/staging/media/tegra-video/tegra20.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/staging/media/tegra-video/tegra20.c b/drivers/staging/media/tegra-video/tegra20.c index eb1fc5b7e2cd..cdadff98eae7 100644 --- a/drivers/staging/media/tegra-video/tegra20.c +++ b/drivers/staging/media/tegra-video/tegra20.c @@ -429,12 +429,13 @@ static int tegra20_channel_host1x_syncpt_init(struct tegra_vi_channel *chan) if (!out_sp) return dev_err_probe(vi->dev, -EBUSY, "failed to request mw ack syncpoint\n"); - chan->mw_ack_sp[0] = out_sp; - fs_sp = host1x_syncpt_request(&vi->client, HOST1X_SYNCPT_CLIENT_MANAGED); - if (!fs_sp) + if (!fs_sp) { + host1x_syncpt_put(out_sp); return dev_err_probe(vi->dev, -EBUSY, "failed to request frame start syncpoint\n"); + } + chan->mw_ack_sp[0] = out_sp; chan->frame_start_sp[0] = fs_sp; return 0;