From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794063144; b=HaF5yvtF00YrkFv0FYBgMhcorycwpM0+hYygUNDgvXn3+p0QbSxHUkgWXKdU5xGeMp4k k3E2u3MCTz0aJJZSopEgamxN8hfgWOxResnAGVsr8jXZtPqlfn+rGSy3EJFamCaTwxwWT pWQt5oAGZicHGxXt47VxEGMzn4DGv7UVPVS1wql7aO9yjTrRG3OxIRe7w2uhdSpQxlg3o lRMzYKRAk3IiGOch1iu88uGHRXtc8mlkTXO5Duk90xSUCfdECTZud48BervvcHCvxMx8t in6d2sW5IVHPwvob6RLfTHKpe/2avg5m5H7bIYWktSPD2DJdfmQZbzxRpVgOEmiqJ5g== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794063144; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=dBvcnhXfQsiEVeS+I4j3ID5YsDAyJYfjXbQEhPeRCis=; b=KOxFvVhWv3CQvMFRlM58IDiuCnhcyJxy8cLPEszVRSrSjIVzf74DitclPm2c467pzG8v k7UVy+dCy77vY3sCzeQzaGFpkqkcXTH+6t9BEdJDbWyk7DK7J9/mV8ICfLpEd98ScU6wU DFwHhA33Da9+GOkIf3U+LRli3GpciWld/80muz6SIeBfuzbg1/AZnvY6jN3kvWLYg0i6V ym5ChkHhl6qrbaC+2+hrZfkvdeiJ8G2a/g2kyprVn9QpFjTkEj5nDo66nOy4Sc+kZ+Ob9 EEfYfi8oJLdDB7eke4CiF0EPrW/F6EIVuFiaKnxdQPrPRHTTnADhY4yQWmPlxfB4jEA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=B477wS3V; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E5C11606A326; Sat, 7 Nov 2026 14:52:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=B477wS3V Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5B1721F0089F; Sat, 7 Nov 2026 14:52:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794063143; bh=dBvcnhXfQsiEVeS+I4j3ID5YsDAyJYfjXbQEhPeRCis=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=B477wS3V9mg2rKmjwbDGAyKZS/PqJEYhT5NrPvdn8Md2pwB2iBKgGB8OYSALJFe4M u06/cDWyqkjuedG1cLHXp0Eor00FNJS/LCNgWYEo+Nv7s+/kGje4Qr9qIrQkLjC7S2 zuMw+lrboiLfDvO3Dc15KK8WpAqniPKz4d1PLeGw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Michail Tatas , Frank Li , Nicolas Dufresne , Hans Verkuil , Sasha Levin Subject: [PATCH 6.18 353/869] media: verisilicon: rockchip: Fix leaks in init Date: Sat, 7 Nov 2026 08:50:35 -0500 Message-ID: <20261107134904.341301649@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134852.069646174@linuxfoundation.org> References: <20261107134852.069646174@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michail Tatas [ Upstream commit 96f6b5e2295996a9e2dd1e2382d3872f98cbb554 ] If one of the dma_alloc_coherent in the init function fails then the previously allocated ones leak. Fix by freeing them in the error path. Fixes: 727a400686a2 ("media: verisilicon: Add Rockchip AV1 decoder") Cc: stable@vger.kernel.org Signed-off-by: Michail Tatas Reviewed-by: Frank Li Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin --- .../verisilicon/rockchip_vpu981_hw_av1_dec.c | 68 +++++++++++++++---- 1 file changed, 55 insertions(+), 13 deletions(-) diff --git a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c index 00aa566a4ccdb..2a145433e6d17 100644 --- a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c +++ b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c @@ -369,6 +369,7 @@ void rockchip_vpu981_av1_dec_exit(struct hantro_ctx *ctx) int rockchip_vpu981_av1_dec_init(struct hantro_ctx *ctx) { + int ret = 0; struct hantro_dev *vpu = ctx->dev; struct hantro_av1_dec_hw_ctx *av1_dec = &ctx->av1_dec; @@ -377,39 +378,54 @@ int rockchip_vpu981_av1_dec_init(struct hantro_ctx *ctx) av1_dec->global_model.cpu = dma_alloc_coherent(vpu->dev, GLOBAL_MODEL_SIZE, &av1_dec->global_model.dma, GFP_KERNEL); - if (!av1_dec->global_model.cpu) - return -ENOMEM; + if (!av1_dec->global_model.cpu) { + ret = -ENOMEM; + goto global_model_cpu_err; + } + av1_dec->global_model.size = GLOBAL_MODEL_SIZE; av1_dec->tile_info.cpu = dma_alloc_coherent(vpu->dev, AV1_TILE_INFO_SIZE, &av1_dec->tile_info.dma, GFP_KERNEL); - if (!av1_dec->tile_info.cpu) - return -ENOMEM; + if (!av1_dec->tile_info.cpu) { + ret = -ENOMEM; + goto tile_info_cpu_err; + } + av1_dec->tile_info.size = AV1_TILE_INFO_SIZE; av1_dec->film_grain.cpu = dma_alloc_coherent(vpu->dev, ALIGN(sizeof(struct rockchip_av1_film_grain), 2048), &av1_dec->film_grain.dma, GFP_KERNEL); - if (!av1_dec->film_grain.cpu) - return -ENOMEM; + if (!av1_dec->film_grain.cpu) { + ret = -ENOMEM; + goto film_grain_cpu_err; + } + av1_dec->film_grain.size = ALIGN(sizeof(struct rockchip_av1_film_grain), 2048); av1_dec->prob_tbl.cpu = dma_alloc_coherent(vpu->dev, ALIGN(sizeof(struct av1cdfs), 2048), &av1_dec->prob_tbl.dma, GFP_KERNEL); - if (!av1_dec->prob_tbl.cpu) - return -ENOMEM; + if (!av1_dec->prob_tbl.cpu) { + ret = -ENOMEM; + goto prob_tbl_cpu_err; + } + av1_dec->prob_tbl.size = ALIGN(sizeof(struct av1cdfs), 2048); av1_dec->prob_tbl_out.cpu = dma_alloc_coherent(vpu->dev, ALIGN(sizeof(struct av1cdfs), 2048), &av1_dec->prob_tbl_out.dma, GFP_KERNEL); - if (!av1_dec->prob_tbl_out.cpu) - return -ENOMEM; + if (!av1_dec->prob_tbl_out.cpu) { + ret = -ENOMEM; + goto prob_tbl_out_cpu_err; + } + av1_dec->prob_tbl_out.size = ALIGN(sizeof(struct av1cdfs), 2048); av1_dec->cdfs = &av1_dec->default_cdfs; av1_dec->cdfs_ndvc = &av1_dec->default_cdfs_ndvc; @@ -420,11 +436,37 @@ int rockchip_vpu981_av1_dec_init(struct hantro_ctx *ctx) AV1_TILE_SIZE, &av1_dec->tile_buf.dma, GFP_KERNEL); - if (!av1_dec->tile_buf.cpu) - return -ENOMEM; + if (!av1_dec->tile_buf.cpu) { + ret = -ENOMEM; + goto tile_buf_cpu_err; + } + av1_dec->tile_buf.size = AV1_TILE_SIZE; - return 0; + return ret; + +tile_buf_cpu_err: + dma_free_coherent(vpu->dev, av1_dec->prob_tbl_out.size, + av1_dec->prob_tbl_out.cpu, + av1_dec->prob_tbl_out.dma); +prob_tbl_out_cpu_err: + dma_free_coherent(vpu->dev, av1_dec->prob_tbl.size, + av1_dec->prob_tbl.cpu, + av1_dec->prob_tbl.dma); +prob_tbl_cpu_err: + dma_free_coherent(vpu->dev, av1_dec->film_grain.size, + av1_dec->film_grain.cpu, + av1_dec->film_grain.dma); +film_grain_cpu_err: + dma_free_coherent(vpu->dev, av1_dec->tile_info.size, + av1_dec->tile_info.cpu, + av1_dec->tile_info.dma); +tile_info_cpu_err: + dma_free_coherent(vpu->dev, av1_dec->global_model.size, + av1_dec->global_model.cpu, + av1_dec->global_model.dma); +global_model_cpu_err: + return ret; } static int rockchip_vpu981_av1_dec_prepare_run(struct hantro_ctx *ctx) -- 2.53.0