diff mbox

[01/16] drm/mgag200: Fix memleaks in error path in mgag200_fb_create()

Message ID 1374066449-21714-2-git-send-email-eich@suse.com (mailing list archive)
State New, archived
Headers show

Commit Message

Egbert Eich July 17, 2013, 1:07 p.m. UTC
Some mmemory allocated in mgag200fb_create() was not properly
freed before the function returned with an error.
This patch takes care of this.

Signed-off-by: Egbert Eich <eich@suse.de>
---
 drivers/gpu/drm/mgag200/mgag200_fb.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)
diff mbox

Patch

diff --git a/drivers/gpu/drm/mgag200/mgag200_fb.c b/drivers/gpu/drm/mgag200/mgag200_fb.c
index 964f58c..6453e4c 100644
--- a/drivers/gpu/drm/mgag200/mgag200_fb.c
+++ b/drivers/gpu/drm/mgag200/mgag200_fb.c
@@ -162,13 +162,13 @@  static int mgag200fb_create(struct drm_fb_helper *helper,
 	struct drm_device *dev = mfbdev->helper.dev;
 	struct drm_mode_fb_cmd2 mode_cmd;
 	struct mga_device *mdev = dev->dev_private;
-	struct fb_info *info;
+	struct fb_info *info = NULL;
 	struct drm_framebuffer *fb;
 	struct drm_gem_object *gobj = NULL;
 	struct device *device = &dev->pdev->dev;
 	struct mgag200_bo *bo;
 	int ret;
-	void *sysram;
+	void *sysram = NULL;
 	int size;
 
 	mode_cmd.width = sizes->surface_width;
@@ -191,14 +191,16 @@  static int mgag200fb_create(struct drm_fb_helper *helper,
 		return -ENOMEM;
 
 	info = framebuffer_alloc(0, device);
-	if (info == NULL)
-		return -ENOMEM;
+	if (info == NULL) {
+		ret = -ENOMEM;
+		goto out;
+	}
 
 	info->par = mfbdev;
 
 	ret = mgag200_framebuffer_init(dev, &mfbdev->mfb, &mode_cmd, gobj);
 	if (ret)
-		return ret;
+		goto out;
 
 	mfbdev->sysram = sysram;
 	mfbdev->size = size;
@@ -242,6 +244,15 @@  static int mgag200fb_create(struct drm_fb_helper *helper,
 		      fb->width, fb->height);
 	return 0;
 out:
+	mfbdev->mfb.obj = NULL;
+	vfree(sysram);
+	mfbdev->sysram = NULL;
+	if (info && info->cmap.len)
+		fb_dealloc_cmap(&info->cmap);
+	framebuffer_release(info);
+	mfbdev->helper.fb = NULL;
+	mfbdev->helper.fbdev = NULL;
+
 	return ret;
 }