On Mon, Oct 26, 2026 at 12:58 PM Bart Van Assche <[email protected]> wrote: > > If krealloc() fails, msm_ioctl_gem_info_set_metadata() returns without > unlocking the GEM object. Fix this by jumping to a new label that > unlocks the GEM object before the buffer is freed. This bug has been > detected by the Clang thread-safety analyzer. > > Fixes: 1c8c354098ea ("drm/msm: Add error handling for krealloc in metadata > setup") > Signed-off-by: Bart Van Assche <[email protected]>
You nerd-sniped me into: https://lore.kernel.org/all/[email protected]/ (but I'll take your patch for -fixes and rebase mine on top) BR, -R > --- > drivers/gpu/drm/msm/msm_drv.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c > index 5e8f3ce26b32..7ab808322be6 100644 > --- a/drivers/gpu/drm/msm/msm_drv.c > +++ b/drivers/gpu/drm/msm/msm_drv.c > @@ -571,13 +571,14 @@ static int msm_ioctl_gem_info_set_metadata(struct > drm_gem_object *obj, > krealloc(msm_obj->metadata, metadata_size, GFP_KERNEL); > if (!new_metadata) { > ret = -ENOMEM; > - goto out; > + goto unlock; > } > > msm_obj->metadata = new_metadata; > msm_obj->metadata_size = metadata_size; > memcpy(msm_obj->metadata, buf, metadata_size); > > +unlock: > msm_gem_unlock(obj); > > out:
