frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

modesetting: Fix memory leak on ms_do_pageflip error 

The event allocation for ms_do_pageflip is leaked on error because callers
of ms_do_pageflip have no way of knowing whether or not a page flip
succeeded for any CRTCs. If a page flip succeeded for at least one CRTC,
then it's not safe for the caller to free the event allocation, and the
allocation won't be leaked. The event allocation is only leaked when not a
single CRTC's page flip succeeded.

Since all callers of ms_do_pageflip allocate the event pointer, and all of
them intentionally leak the event allocation when ms_do_pageflip returns an
error, just free the event pointer inside ms_do_pageflip when a page flip
doesn't succeed for any CRTC.

Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
Reviewed-by: Martin Roukala <martin.roukala@mupuf.org>
This commit is contained in:
Sultan Alsawaf 2023-01-22 20:59:32 -08:00
parent be864d8e18
commit 35975d9054
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
hw/xfree86/drivers/modesetting/pageflip.c
View File

@ -336,7 +336,7 @@ ms_do_pageflip(ScreenPtr screen,
xf86DrvMsg(scrn->scrnIndex, X_ERROR,
"%s: Failed to get GBM BO for flip to new front.\n",
log_prefix);
return FALSE;
goto error_free_event;
}
flipdata = calloc(1, sizeof(struct ms_flipdata));
@ -344,7 +344,7 @@ ms_do_pageflip(ScreenPtr screen,
drmmode_bo_destroy(&ms->drmmode, &new_front_bo);
xf86DrvMsg(scrn->scrnIndex, X_ERROR,
"%s: Failed to allocate flipdata.\n", log_prefix);
return FALSE;
goto error_free_event;
}
flipdata->event = event;
@ -465,11 +465,16 @@ error_out:
drmmode_bo_destroy(&ms->drmmode, &new_front_bo);
/* if only the local reference - free the structure,
* else drop the local reference and return */
if (flipdata->flip_count == 1)
if (flipdata->flip_count == 1) {
free(flipdata);
else
} else {
flipdata->flip_count--;
return FALSE;
}
error_free_event:
/* Free the event since the caller has no way to know it's safe to free */
free(event);
return FALSE;
}