tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/colorop: Fix blob property reference tracking in state lifecycle

The colorop state blob property handling had memory leaks during state
duplication, destruction, and reset operations. The implementation
failed to follow the established pattern from drm_crtc's handling of
DEGAMMA/GAMMA blob properties.

Issues fixed:
- drm_colorop_atomic_destroy_state() was freeing state memory without
releasing the blob reference, causing a leak
- drm_colorop_reset() was directly freeing old state with kfree()
instead of properly destroying it, leaking blob references
- drm_colorop_cleanup() had duplicate blob cleanup code

Changes:
- Add __drm_atomic_helper_colorop_destroy_state() helper to properly
release blob references before freeing state memory
- Update drm_colorop_atomic_destroy_state() to call the helper
- Fix drm_colorop_reset() to use drm_colorop_atomic_destroy_state()
for proper cleanup of old state
- Simplify drm_colorop_cleanup() to use the common destruction path

This matches the well-tested pattern used by drm_crtc since 2016 and
ensures proper reference counting throughout the state lifecycle.

Co-developed by Claude Sonnet 4.5.

Fixes: cfc27680ee20 ("drm/colorop: Introduce new drm_colorop mode object")
Cc: Simon Ser <contact@emersion.fr>
Cc: Alex Hung <alex.hung@amd.com>
Cc: Harry Wentland <harry.wentland@amd.com>
Cc: Daniel Stone <daniels@collabora.com>
Cc: Melissa Wen <mwen@igalia.com>
Cc: Sebastian Wick <sebastian.wick@redhat.com>
Cc: Uma Shankar <uma.shankar@intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Louis Chauvet <louis.chauvet@bootlin.com>
Cc: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
Cc: <stable@vger.kernel.org> #v6.19+
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Alex Hung <alex.hung@amd.com>
Link: https://patch.msgid.link/20260312204145.829714-1-harry.wentland@amd.com

Harry Wentland 235b333e bc4cb68a

+19 -7
+19 -7
drivers/gpu/drm/drm_colorop.c
··· 171 171 list_del(&colorop->head); 172 172 config->num_colorop--; 173 173 174 - if (colorop->state && colorop->state->data) { 175 - drm_property_blob_put(colorop->state->data); 176 - colorop->state->data = NULL; 177 - } 178 - 179 - kfree(colorop->state); 174 + if (colorop->state) 175 + drm_colorop_atomic_destroy_state(colorop, colorop->state); 180 176 } 181 177 EXPORT_SYMBOL(drm_colorop_cleanup); 182 178 ··· 481 485 return state; 482 486 } 483 487 488 + /** 489 + * __drm_atomic_helper_colorop_destroy_state - release colorop state 490 + * @state: colorop state object to release 491 + * 492 + * Releases all resources stored in the colorop state without actually freeing 493 + * the memory of the colorop state. This is useful for drivers that subclass the 494 + * colorop state. 495 + */ 496 + static void __drm_atomic_helper_colorop_destroy_state(struct drm_colorop_state *state) 497 + { 498 + drm_property_blob_put(state->data); 499 + } 500 + 484 501 void drm_colorop_atomic_destroy_state(struct drm_colorop *colorop, 485 502 struct drm_colorop_state *state) 486 503 { 504 + __drm_atomic_helper_colorop_destroy_state(state); 487 505 kfree(state); 488 506 } 489 507 ··· 548 538 549 539 void drm_colorop_reset(struct drm_colorop *colorop) 550 540 { 551 - kfree(colorop->state); 541 + if (colorop->state) 542 + drm_colorop_atomic_destroy_state(colorop, colorop->state); 543 + 552 544 colorop->state = kzalloc_obj(*colorop->state); 553 545 554 546 if (colorop->state)