tegra_bo_alloc_object() allocates bo and passes its embedded GEM object
to drm_gem_object_init().
drm_gem_object_init() initializes the GEM private state before creating
the shmem backing file. If the file creation fails, it returns an error
with the reservation object and GPUVA mutex still initialized.
The current error path directly frees bo, bypassing the matching GEM
private-object cleanup. Finalize the partially initialized GEM object
with drm_gem_private_object_fini() before freeing bo.
This issue was found by a static analysis tool I am developing.
Fixes: c28d4a317fef ("drm/tegra: gem: Extract tegra_bo_alloc_object()")
Signed-off-by: Guangshuo Li <[email protected]>
---
drivers/gpu/drm/tegra/gem.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
index 436394e04812..eb513cb7521c 100644
--- a/drivers/gpu/drm/tegra/gem.c
+++ b/drivers/gpu/drm/tegra/gem.c
@@ -314,8 +314,10 @@ static struct tegra_bo *tegra_bo_alloc_object(struct
drm_device *drm,
size = round_up(size, PAGE_SIZE);
err = drm_gem_object_init(drm, &bo->gem, size);
- if (err < 0)
+ if (err < 0) {
+ drm_gem_private_object_fini(&bo->gem);
goto free;
+ }
err = drm_gem_create_mmap_offset(&bo->gem);
if (err < 0)
--
2.43.0
