On Sun Jul 26 17:04:08 2026 +0700, Cong Nguyen wrote:
> tegra20_channel_host1x_syncpt_init() requests two host1x syncpoints. It
> stored the first one (mw ack) into chan->mw_ack_sp[0] and only then
> requested the second one (frame start). If the second request failed the
> function returned without releasing the first syncpoint, leaking it: the
> caller tegra_channel_init() bails out with a bare "return ret" on a
> syncpt init failure and does not run its free_syncpts error path (that
> path only covers failures after syncpoint init has fully succeeded), and
> the channel is subsequently torn down via the kfree()-only path, so
> nothing ever releases the orphaned syncpoint.
>
> Release the already-acquired syncpoint on the error path, and only
> publish the syncpoints into the channel once both have been successfully
> requested, so chan->mw_ack_sp[0] never holds a released handle. This
> matches the handling in tegra210_channel_host1x_syncpt_init().
>
> Fixes: 0e2c4117c351 ("staging: media: tegra-video: add CSI support for
> Tegra20 and Tegra30")
> Signed-off-by: Cong Nguyen <[email protected]>
> Reviewed-by: Mikko Perttunen <[email protected]>
> Reviewed-by: Svyatoslav Ryhel <[email protected]>
> Reviewed-by: Luca Ceresoli <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/staging/media/tegra-video/tegra20.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
---
diff --git a/drivers/staging/media/tegra-video/tegra20.c
b/drivers/staging/media/tegra-video/tegra20.c
index eb1fc5b7e2cd..cdadff98eae7 100644
--- a/drivers/staging/media/tegra-video/tegra20.c
+++ b/drivers/staging/media/tegra-video/tegra20.c
@@ -429,12 +429,13 @@ static int tegra20_channel_host1x_syncpt_init(struct
tegra_vi_channel *chan)
if (!out_sp)
return dev_err_probe(vi->dev, -EBUSY, "failed to request mw ack
syncpoint\n");
- chan->mw_ack_sp[0] = out_sp;
-
fs_sp = host1x_syncpt_request(&vi->client,
HOST1X_SYNCPT_CLIENT_MANAGED);
- if (!fs_sp)
+ if (!fs_sp) {
+ host1x_syncpt_put(out_sp);
return dev_err_probe(vi->dev, -EBUSY, "failed to request frame
start syncpoint\n");
+ }
+ chan->mw_ack_sp[0] = out_sp;
chan->frame_start_sp[0] = fs_sp;
return 0;
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
