Re: [PATCH] staging: media: tegra-video: fix syncpoint leak in tegra20 channel init
Svyatoslav Ryhel <[email protected]> Mon, 27 Jul 2026 11:10:17 +0300
| Newsgroups | org.kernel.vger.linux-tegra,dev.linux.lists.linux-staging,org.kernel.vger.linux-kernel,org.kernel.vger.linux-media |
|---|---|
| Message-ID | <CAPVz0n1V1YJsEJ3+SbkMnTzCbhyx3vJP2OuCPe1Ft1+ukynxHg@mail.gmail.com> |
нд, 26 лип. 2026 р. о 13:04 Cong Nguyen <[email protected]> пише: > > tegra20_channel_host1x_syncpt_init() requests two host1x syncpoints. It > stored the first one (mw ack) into chan->mw_ack_sp[0] and only then > requested the second one (frame start). If the second request failed the > function returned without releasing the first syncpoint, leaking it: the > caller tegra_channel_init() bails out with a bare "return ret" on a > syncpt init failure and does not run its free_syncpts error path (that > path only covers failures after syncpoint init has fully succeeded), and > the channel is subsequently torn down via the kfree()-only path, so > nothing ever releases the orphaned syncpoint. > > Release the already-acquired syncpoint on the error path, and only > publish the syncpoints into the channel once both have been successfully > requested, so chan->mw_ack_sp[0] never holds a released handle. This > matches the handling in tegra210_channel_host1x_syncpt_init(). > > Fixes: 0e2c4117c351 ("staging: media: tegra-video: add CSI support for Tegra20 and Tegra30") > Signed-off-by: Cong Nguyen <[email protected]> > --- > drivers/staging/media/tegra-video/tegra20.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > Very nice, thank you! Reviewed-by: Svyatoslav Ryhel <[email protected]>