drm: Fix memory leak in drm_mode_setcrtc()

The mode passed to the .set_config() hook was never freed. The drivers
will make a copy of the mode, so simply free it when done.

Issue: ANDROID-2160
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>

diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index b452cc1..01b4d6f 100644 (file)
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -635,6 +635,9 @@ EXPORT_SYMBOL(drm_mode_create);
  */
 void drm_mode_destroy(struct drm_device *dev, struct drm_display_mode *mode)
 {
+       if (!mode)
+               return;
+
        drm_mode_object_put(dev, &mode->base);
 
        kfree(mode);
@@ -2021,6 +2024,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
                }
 
                mode = drm_mode_create(dev);
+               if (!mode) {
+                       ret = -ENOMEM;
+                       goto out;
+               }
+
                drm_crtc_convert_umode(mode, &crtc_req->mode);
                drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
        }
@@ -2090,6 +2098,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
 
 out:
        kfree(connector_set);
+       drm_mode_destroy(dev, mode);
        mutex_unlock(&dev->mode_config.mutex);
        return ret;
 }