[COMMON] media: mfc: fix the memory leak

If driver failed to get dmabuf of specific plane not plane0,
the dmabuf of previous plane doesn't be released.

Change-Id: I7c41ac3717fbd274a2213a56be2f2f98401fb993
Signed-off-by: Ayoung Sim <a.sim@samsung.com>

diff --git a/drivers/media/platform/exynos/mfc/s5p_mfc_enc_vb2_ops.c b/drivers/media/platform/exynos/mfc/s5p_mfc_enc_vb2_ops.c
index e0df63d0ca49c080bcc3f0f346c4a8cd9527aa77..b995e647aa7618d65785ac7ccea20d2f42d8e7df 100644 (file)
--- a/drivers/media/platform/exynos/mfc/s5p_mfc_enc_vb2_ops.c
+++ b/drivers/media/platform/exynos/mfc/s5p_mfc_enc_vb2_ops.c
@@ -160,8 +160,8 @@ static int s5p_mfc_enc_buf_prepare(struct vb2_buffer *vb)
        struct s5p_mfc_raw_info *raw;
        unsigned int index = vb->index;
        struct s5p_mfc_buf *buf = vb_to_mfc_buf(vb);
-       struct dma_buf *dmabuf;
-       int i;
+       struct dma_buf *dmabuf[MFC_MAX_PLANES];
+       int i, mem_get_count = 0;
 
        mfc_debug_enter();
 
@@ -198,16 +198,18 @@ static int s5p_mfc_enc_buf_prepare(struct vb2_buffer *vb)
                }
 
                for (i = 0; i < ctx->src_fmt->mem_planes; i++) {
-                       dmabuf = s5p_mfc_mem_get_dmabuf(vb->planes[i].m.fd);
-                       if (!dmabuf)
-                               return -ENOMEM;
+                       dmabuf[i] = dma_buf_get(vb->planes[i].m.fd);
+                       if (IS_ERR(dmabuf[i])) {
+                               mfc_err_ctx("failed to get bufcon dmabuf\n");
+                               goto err_mem_put;
+                       }
 
-                       buf->num_bufs_in_vb = s5p_mfc_bufcon_get_buf_count(dmabuf);
+                       mem_get_count++;
+                       buf->num_bufs_in_vb = s5p_mfc_bufcon_get_buf_count(dmabuf[i]);
                        mfc_debug(3, "bufcon count:%d\n", buf->num_bufs_in_vb);
                        if (buf->num_bufs_in_vb == 0) {
                                mfc_err_ctx("bufcon count couldn't be zero\n");
-                               s5p_mfc_mem_put_dmabuf(dmabuf);
-                               return -ENOMEM;
+                               goto err_mem_put;
                        }
 
                        if (buf->num_bufs_in_vb < 0)
@@ -224,19 +226,18 @@ static int s5p_mfc_enc_buf_prepare(struct vb2_buffer *vb)
                                ctx->framerate = buf->num_bufs_in_vb * ENC_DEFAULT_CAM_CAPTURE_FPS;
                                mfc_debug(3, "framerate: %ld\n", ctx->framerate);
 
-                               count = s5p_mfc_bufcon_get_daddr(ctx, buf, dmabuf, i);
+                               count = s5p_mfc_bufcon_get_daddr(ctx, buf, dmabuf[i], i);
                                if (count != buf->num_bufs_in_vb) {
-                                       s5p_mfc_mem_put_dmabuf(dmabuf);
                                        mfc_err_ctx("invalid buffer count %d != num_bufs_in_vb %d\n",
                                                        count, buf->num_bufs_in_vb);
-                                       return -EFAULT;
+                                       goto err_mem_put;
                                }
 
-                               s5p_mfc_mem_put_dmabuf(dmabuf);
+                               dma_buf_put(dmabuf[i]);
                        } else {
                                dma_addr_t start_raw;
 
-                               s5p_mfc_mem_put_dmabuf(dmabuf);
+                               dma_buf_put(dmabuf[i]);
                                start_raw = s5p_mfc_mem_get_daddr_vb(vb, 0);
                                if (start_raw == 0) {
                                        mfc_err_ctx("Plane mem not allocated.\n");
@@ -269,8 +270,13 @@ static int s5p_mfc_enc_buf_prepare(struct vb2_buffer *vb)
        }
 
        mfc_debug_leave();
-
        return 0;
+
+err_mem_put:
+       for (i = 0; i < mem_get_count; i++)
+               dma_buf_put(dmabuf[i]);
+
+       return -ENOMEM;
 }
 
 static void s5p_mfc_enc_buf_finish(struct vb2_buffer *vb)

diff --git a/drivers/media/platform/exynos/mfc/s5p_mfc_mem.h b/drivers/media/platform/exynos/mfc/s5p_mfc_mem.h
index eb14659edca2c0a9eec4f3ebabe23139fc673d60..cca58a968060b523f9464877f92dbd6a88212f83 100644 (file)
--- a/drivers/media/platform/exynos/mfc/s5p_mfc_mem.h
+++ b/drivers/media/platform/exynos/mfc/s5p_mfc_mem.h
@@ -30,21 +30,6 @@ static inline dma_addr_t s5p_mfc_mem_get_daddr_vb(
        return addr;
 }
 
-static inline struct dma_buf *s5p_mfc_mem_get_dmabuf(int fd)
-{
-       struct dma_buf *dmabuf = NULL;
-
-       dmabuf = dma_buf_get(fd);
-       WARN_ON(dmabuf == NULL);
-
-       return dmabuf;
-}
-
-static inline void s5p_mfc_mem_put_dmabuf(struct dma_buf *dmabuf)
-{
-       dma_buf_put(dmabuf);
-}
-
 static inline int s5p_mfc_bufcon_get_buf_count(struct dma_buf *dmabuf)
 {
        return dmabuf_container_get_count(dmabuf);