From: Ameer Hamza amhamza.mgc@gmail.com
commit 8403fdd775858a7bf04868d43daea0acbe49ddfc upstream.
The venus_helper_alloc_dpb_bufs() implementation allows an early return on an error path when checking the id from ida_alloc_min() which would not release the earlier buffer allocation.
Move the direct kfree() from the error checking of dma_alloc_attrs() to the common fail path to ensure that allocations are released on all error paths in this function.
Addresses-Coverity: 1494120 ("Resource leak")
cc: stable@vger.kernel.org # 5.16+ Fixes: 40d87aafee29 ("media: venus: vdec: decoded picture buffer handling during reconfig sequence") Signed-off-by: Ameer Hamza amhamza.mgc@gmail.com Reviewed-by: Kieran Bingham kieran.bingham+renesas@ideasonboard.com Signed-off-by: Stanimir Varbanov stanimir.varbanov@linaro.org Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/media/platform/qcom/venus/helpers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/qcom/venus/helpers.c +++ b/drivers/media/platform/qcom/venus/helpers.c @@ -189,7 +189,6 @@ int venus_helper_alloc_dpb_bufs(struct v buf->va = dma_alloc_attrs(dev, buf->size, &buf->da, GFP_KERNEL, buf->attrs); if (!buf->va) { - kfree(buf); ret = -ENOMEM; goto fail; } @@ -209,6 +208,7 @@ int venus_helper_alloc_dpb_bufs(struct v return 0;
fail: + kfree(buf); venus_helper_free_dpb_bufs(inst); return ret; }