From 46862145d4a24875e5ae5262f67f48ed1b317533 Mon Sep 17 00:00:00 2001 From: Masami Ichikawa Date: Wed, 25 Dec 2013 23:47:37 +0900 Subject: [PATCH] fbcon: Fix memory leak in fbcon_exit(). kmemleak reported a memory leak as below. unreferenced object 0xffff880036ca84c0 (size 16): comm "swapper/0", pid 1, jiffies 4294877407 (age 4434.633s) hex dump (first 16 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ................ backtrace: [] kmemleak_alloc+0x4e/0xb0 [] __kmalloc+0x1fc/0x290 [] bit_cursor+0x24e/0x6c0 [] fbcon_cursor+0x154/0x1d0 [] hide_cursor+0x28/0xa0 [] update_region+0x6f/0x90 [] fbcon_switch+0x518/0x550 [] redraw_screen+0x189/0x240 [] do_bind_con_driver+0x360/0x380 [] do_take_over_console+0x114/0x1c0 [] do_fbcon_takeover+0x63/0xd0 [] fbcon_event_notify+0x605/0x720 [] notifier_call_chain+0x4c/0x70 [] __blocking_notifier_call_chain+0x4d/0x70 [] blocking_notifier_call_chain+0x16/0x20 [] fb_notifier_call_chain+0x1b/0x20 In this case ops->cursor_state.mask is allocated in bit_cursor() but not freed in fbcon_exit(). So, fbcon_exit() needs to free buffer in its process. In the case, fbcon_exit() was called from fbcon_deinit() when driver called remove_conflicting_framebuffers(). Signed-off-by: Masami Ichikawa Signed-off-by: Tomi Valkeinen --- drivers/video/console/fbcon.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c index f39931f818b8..4e39291ac8b4 100644 --- a/drivers/video/console/fbcon.c +++ b/drivers/video/console/fbcon.c @@ -3563,6 +3563,7 @@ static void fbcon_exit(void) fbcon_del_cursor_timer(info); kfree(ops->cursor_src); + kfree(ops->cursor_state.mask); kfree(info->fbcon_par); info->fbcon_par = NULL; }