FAILED: patch "[PATCH] drm: fix drm_dp_mst_port refcount leaks in" failed to apply to 4.14-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From a34a0a632dd991a371fec56431d73279f9c54029 Mon Sep 17 00:00:00 2001
From: Xin Xiong <[email protected]>
Date: Sun, 19 Jul 2020 23:45:45 +0800
Subject: [PATCH] drm: fix drm_dp_mst_port refcount leaks in
drm_dp_mst_allocate_vcpi
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
drm_dp_mst_allocate_vcpi() invokes drm_dp_mst_topology_get_port_validated(), which increases the refcount of the "port".
These reference counting issues take place in two exception handling paths separately. Either when “slots” is less than 0 or when drm_dp_init_vcpi() returns a negative value, the function forgets to reduce the refcnt increased drm_dp_mst_topology_get_port_validated(), which results in a refcount leak.
Fix these issues by pulling up the error handling when "slots" is less than 0, and calling drm_dp_mst_topology_put_port() before termination when drm_dp_init_vcpi() returns a negative value.
drivers/gpu/drm/drm_dp_mst_topology.c +4 -3
@@ -4308,11 +4308,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr, {int ret; - port =drm_dp_mst_topology_get_port_validated (mgr, port); -if (!port) +if (slots <0 )return false; -if (slots <0 ) + port =drm_dp_mst_topology_get_port_validated (mgr, port); +if (!port)return false;if (port->vcpi.vcpi >0 ) {
@@ -4328,6 +4328,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr,if (ret) {DRM_DEBUG_KMS ("failed to init vcpi slots=%d max=63 ret=%d\n" ,DIV_ROUND_UP (pbn, mgr->pbn_div), ret); +drm_dp_mst_topology_put_port (port); goto out; } DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n",