From 20c43e79ff3f5f92431fb6feb903640cf3ac0c32 Mon Sep 17 00:00:00 2001 From: jianjunm Date: Tue, 16 Jul 2024 11:39:54 +0800 Subject: [PATCH] host1x-fence:Free the kzalloc mem Issue: ioctl call host1x-fence cause memory leak The kmemleak log shows: unreferenced object 0xffff0001ac305500 (size 128): comm "deepstream-test", pid 4370, jiffies 4295045195 (age 133.220s) hex dump (first 32 bytes): 00 01 00 00 00 00 ad de 22 01 00 00 00 00 ad de ........"....... 28 aa 67 bf 00 00 ff ff 00 7c ed 1f 01 00 ff ff (.g......|...... backtrace: [<000000000d2d94dc>] kmem_cache_alloc_trace+0x2bc/0x3d0 [<000000006a957993>] dev_file_ioctl+0x588/0x86c [host1x_fence] [<000000003528f698>] __arm64_sys_ioctl+0xb4/0x100 [<00000000d39dabe0>] invoke_syscall+0x5c/0x130 [<00000000aee791e3>] el0_svc_common.constprop.0+0x64/0x110 [<0000000050bcd11c>] do_el0_svc+0x74/0xa0 [<00000000530f0cc4>] el0_svc+0x28/0x80 [<00000000b6d076a3>] el0t_64_sync_handler+0xa4/0x130 [<000000008943bb27>] el0t_64_sync+0x1a4/0x1a8 Fix: release the kzalloc memory after finish using Bug 4738188 Change-Id: Ifeb316a2a52432f0199ad22d3de277b123acda24 Signed-off-by: jianjunm Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3175899 (cherry picked from commit 84de93750161ae44f1e2b3f1272380ce220760c3) Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3181288 GVS: buildbot_gerritrpt Reviewed-by: Bibek Basu Reviewed-by: Santosh BS --- drivers/gpu/host1x-fence/dev.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/host1x-fence/dev.c b/drivers/gpu/host1x-fence/dev.c index 01c83f57..a6988b0f 100644 --- a/drivers/gpu/host1x-fence/dev.c +++ b/drivers/gpu/host1x-fence/dev.c @@ -1,9 +1,5 @@ // SPDX-License-Identifier: GPL-2.0-only -/* - * Host1x fence UAPI - * - * Copyright (c) 2022-2024, NVIDIA CORPORATION. All rights reserved. - */ +// SPDX-FileCopyrightText: Copyright (c) 2022-2024, NVIDIA CORPORATION & AFFILIATES. All rights reserved. #include @@ -205,20 +201,23 @@ struct host1x_pollfd { static int host1x_pollfd_release(struct inode *inode, struct file *file) { struct host1x_pollfd *pollfd = file->private_data; - struct host1x_pollfd_fence *pfd_fence; + struct host1x_pollfd_fence *pfd_fence, *pfd_fence_temp; mutex_lock(&pollfd->lock); - list_for_each_entry(pfd_fence, &pollfd->fences, list) { + list_for_each_entry_safe(pfd_fence, pfd_fence_temp, &pollfd->fences, list) { if (pfd_fence->callback_set) { if (dma_fence_remove_callback(pfd_fence->fence, &pfd_fence->callback)) host1x_fence_cancel(pfd_fence->fence); } dma_fence_put(pfd_fence->fence); + kfree(pfd_fence); } mutex_unlock(&pollfd->lock); + kfree(pollfd); + return 0; } @@ -237,6 +236,7 @@ static unsigned int host1x_pollfd_poll(struct file *file, poll_table *wait) mask = POLLPRI | POLLIN; dma_fence_put(pfd_fence->fence); list_del(&pfd_fence->list); + kfree(pfd_fence); } }