linux-kernel - [PATCH 2/2] media: iris: fix memory leak while freeing queue memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250109-iris-driver-fixes-v1-2-789a0f5dd7ee@quicinc.com>
Date: Thu, 9 Jan 2025 16:56:41 +0530
From: Dikshita Agarwal <quic_dikshita@...cinc.com>
To: Vikash Garodia <quic_vgarodia@...cinc.com>,
        Abhinav Kumar
	<quic_abhinavk@...cinc.com>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Stefan Schmidt <stefan.schmidt@...aro.org>
CC: Hans Verkuil <hverkuil@...all.nl>, Joel Stanley <joel@....id.au>,
        <linux-media@...r.kernel.org>, <linux-arm-msm@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>,
        Dikshita Agarwal <quic_dikshita@...cinc.com>,
        <20241212-qcom-video-iris-v9-0-e8c2c6bd4041@...cinc.com>
Subject: [PATCH 2/2] media: iris: fix memory leak while freeing queue
 memory

Memory allocated for shared queues is not freed completely in tear down
sequence. Fix it by passing the correct value while freeing the queue
memory.

Signed-off-by: Dikshita Agarwal <quic_dikshita@...cinc.com>
---
 drivers/media/platform/qcom/iris/iris_hfi_queue.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/qcom/iris/iris_hfi_queue.c b/drivers/media/platform/qcom/iris/iris_hfi_queue.c
index 9195715c5d5a..d1113708644b 100644
--- a/drivers/media/platform/qcom/iris/iris_hfi_queue.c
+++ b/drivers/media/platform/qcom/iris/iris_hfi_queue.c
@@ -292,6 +292,7 @@ int iris_hfi_queues_init(struct iris_core *core)
 
 void iris_hfi_queues_deinit(struct iris_core *core)
 {
+	u32 queue_size;
 	if (!core->iface_q_table_vaddr)
 		return;
 
@@ -305,9 +306,10 @@ void iris_hfi_queues_deinit(struct iris_core *core)
 	core->sfr_vaddr = NULL;
 	core->sfr_daddr = 0;
 
-	dma_free_attrs(core->dev, sizeof(struct iris_hfi_queue_table_header),
-		       core->iface_q_table_vaddr, core->iface_q_table_daddr,
-		       DMA_ATTR_WRITE_COMBINE);
+	queue_size = ALIGN(sizeof(struct iris_hfi_queue_table_header) +
+		(IFACEQ_QUEUE_SIZE * IFACEQ_NUMQ), SZ_4K);
+	dma_free_attrs(core->dev, queue_size, core->iface_q_table_vaddr,
+		       core->iface_q_table_daddr, DMA_ATTR_WRITE_COMBINE);
 
 	core->iface_q_table_vaddr = NULL;
 	core->iface_q_table_daddr = 0;

-- 
2.34.1