The error paths in DRM bus drivers currently leak memory as they don't
correctly revert drm_dev_alloc(). Introduce drm_dev_free() to free DRM
devices which haven't been registered, yet.
We must be careful not to introduce any side-effects with cleanups done in
drm_dev_free(). drm_ht_remove(), drm_ctxbitmap_cleanup() and
drm_gem_destroy() are all fine in that regard.
Signed-off-by: David Herrmann <dh.herrmann at gmail.com>
---
drivers/gpu/drm/drm_pci.c | 2 +-
drivers/gpu/drm/drm_platform.c | 2 +-
drivers/gpu/drm/drm_stub.c | 35 +++++++++++++++++++++++++----------
drivers/gpu/drm/drm_usb.c | 2 +-
include/drm/drmP.h | 1 +
5 files changed, 29 insertions(+), 13 deletions(-)
diff --git a/drivers/gpu/drm/drm_pci.c b/drivers/gpu/drm/drm_pci.c
index 0daee24..8ffc23d 100644
--- a/drivers/gpu/drm/drm_pci.c
+++ b/drivers/gpu/drm/drm_pci.c
@@ -356,7 +356,7 @@ int drm_get_pci_dev(struct pci_dev *pdev, const struct
pci_device_id *ent,
err_pci:
pci_disable_device(pdev);
err_free:
- kfree(dev);
+ drm_dev_free(dev);
return ret;
}
EXPORT_SYMBOL(drm_get_pci_dev);
diff --git a/drivers/gpu/drm/drm_platform.c b/drivers/gpu/drm/drm_platform.c
index 396713e..2b99ef0 100644
--- a/drivers/gpu/drm/drm_platform.c
+++ b/drivers/gpu/drm/drm_platform.c
@@ -64,7 +64,7 @@ int drm_get_platform_dev(struct platform_device *platdev,
return 0;
err_free:
- kfree(dev);
+ drm_dev_free(dev);
return ret;
}
EXPORT_SYMBOL(drm_get_platform_dev);
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index f016ed8..8497dd1 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -374,7 +374,6 @@ static void drm_unplug_minor(struct drm_minor *minor)
*/
void drm_put_dev(struct drm_device *dev)
{
- struct drm_driver *driver;
struct drm_map_list *r_list, *list_temp;
DRM_DEBUG("\n");
@@ -383,7 +382,6 @@ void drm_put_dev(struct drm_device *dev)
DRM_ERROR("cleanup called no dev\n");
return;
}
- driver = dev->driver;
drm_lastclose(dev);
@@ -397,21 +395,15 @@ void drm_put_dev(struct drm_device *dev)
list_for_each_entry_safe(r_list, list_temp, &dev->maplist, head)
drm_rmmap(dev, r_list->map);
- drm_ht_remove(&dev->map_hash);
-
- drm_ctxbitmap_cleanup(dev);
if (drm_core_check_feature(dev, DRIVER_MODESET))
drm_put_minor(&dev->control);
- if (driver->driver_features & DRIVER_GEM)
- drm_gem_destroy(dev);
-
drm_put_minor(&dev->primary);
list_del(&dev->driver_item);
- kfree(dev->devname);
- kfree(dev);
+
+ drm_dev_free(dev);
}
EXPORT_SYMBOL(drm_put_dev);
@@ -508,6 +500,29 @@ err_free:
EXPORT_SYMBOL(drm_dev_alloc);
/**
+ * drm_dev_free - Free DRM device
+ * @dev: DRM device to free
+ *
+ * Free a DRM device that has previously been allocated via drm_dev_alloc().
+ * You must not use kfree() instead or you will leak memory.
+ *
+ * This must not be called once the device got registered. Use drm_put_dev()
+ * instead, which then calls drm_dev_free().
+ */
+void drm_dev_free(struct drm_device *dev)
+{
+ if (dev->driver->driver_features & DRIVER_GEM)
+ drm_gem_destroy(dev);
+
+ drm_ctxbitmap_cleanup(dev);
+ drm_ht_remove(&dev->map_hash);
+
+ kfree(dev->devname);
+ kfree(dev);
+}
+EXPORT_SYMBOL(drm_dev_free);
+
+/**
* drm_dev_register - Register DRM device
* @dev: Device to register
*
diff --git a/drivers/gpu/drm/drm_usb.c b/drivers/gpu/drm/drm_usb.c
index 54d60f2..bace9d9 100644
--- a/drivers/gpu/drm/drm_usb.c
+++ b/drivers/gpu/drm/drm_usb.c
@@ -29,7 +29,7 @@ int drm_get_usb_dev(struct usb_interface *interface,
return 0;
err_free:
- kfree(dev);
+ drm_dev_free(dev);
return ret;
}
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index 30f83ee..d75f061 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -1707,6 +1707,7 @@ static __inline__ void drm_core_dropmap(struct
drm_local_map *map)
struct drm_device *drm_dev_alloc(struct drm_driver *driver,
struct device *parent);
+void drm_dev_free(struct drm_device *dev);
int drm_dev_register(struct drm_device *dev);
int drm_get_minor(struct drm_device *dev, struct drm_minor **minor, int type);
/*@}*/
--
1.8.3.3
