Re: [PATCH 03/13] drm/vkms: Fix color pipeline enum name leak

[Alex Hung]

Reviewed-by: Alex Hung <alex.h...@amd.com>

On 12/18/25 23:56, Chaitanya Kumar Borah wrote:

vkms_initialize_colorops() allocates enum names for color pipelines,
which are copied by drm_property_create_enum(). The temporary strings
were not freed, resulting in a memory leak.

Allocate enum names only after successful pipeline construction and
free them on all exit paths

Fixes: c1e578bd08da ("drm/vkms: Add enumerated 1D curve colorop")
Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.bo...@intel.com>
---
  drivers/gpu/drm/vkms/vkms_colorop.c | 15 ++++++++-------
  1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/vkms/vkms_colorop.c 
b/drivers/gpu/drm/vkms/vkms_colorop.c
index 5c3ffc78aea0..d03a1f2e9c41 100644
--- a/drivers/gpu/drm/vkms/vkms_colorop.c
+++ b/drivers/gpu/drm/vkms/vkms_colorop.c
@@ -37,7 +37,6 @@ static int vkms_initialize_color_pipeline(struct drm_plane 
*plane, struct drm_pr
                goto cleanup;

list->type = ops[i]->base.id;

-       list->name = kasprintf(GFP_KERNEL, "Color Pipeline %d", 
ops[i]->base.id);

i++; @@ -88,6 +87,8 @@ static int vkms_initialize_color_pipeline(struct drm_plane *plane, struct drm_pr drm_colorop_set_next_property(ops[i - 1], ops[i]); + list->name = kasprintf(GFP_KERNEL, "Color Pipeline %d", ops[0]->base.id);

+
        return 0;

cleanup:

@@ -103,18 +104,18 @@ static int vkms_initialize_color_pipeline(struct 
drm_plane *plane, struct drm_pr

int vkms_initialize_colorops(struct drm_plane *plane)

  {
-       struct drm_prop_enum_list pipeline;
-       int ret;
+       struct drm_prop_enum_list pipeline = {};
+       int ret = 0;

/* Add color pipeline */

        ret = vkms_initialize_color_pipeline(plane, &pipeline);
        if (ret)
-               return ret;
+               goto out;

/* Create COLOR_PIPELINE property and attach */

        ret = drm_plane_create_color_pipeline_property(plane, &pipeline, 1);
-       if (ret)
-               return ret;

- return 0;

+       kfree(pipeline.name);
+out:
+       return ret;
  }