Re: [PATCH] staging: sm750fb: free cmap on framebuffer release

[Lucas Costa]

Hi, Greg! Found it by code inspection only, compile-tested it. I don't
have the hardware available.


El mar, 22 sept 2026 a las 2:41, Greg Kroah-Hartman
(<gregkh@xxxxxxxxxxxxxxxxxxx>) escribió:
>
> On Tue, Sep 22, 2026 at 12:53:02AM -0300, Lucas Costa wrote:
> > The driver never calls fb_dealloc_cmap() after it has been allocated,
> > so when the buffer is torn down we leak.
> >
> > This happens on every unbind, and when an error is detected in
> > sm750fb_framebuffer_alloc().
> >
> > fb_dealloc_cmap() gets called before framebuffer_release() in both places.
> >
> > Fixes: 81dee67e215b ("staging: sm750fb: add sm750 to staging")
> >
> > Signed-off-by: Lucas Costa <2000.costalucas@xxxxxxxxx>
> > ---
> >  drivers/staging/sm750fb/sm750.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
> > index 8b93bfeb217b..92412534239c 100644
> > --- a/drivers/staging/sm750fb/sm750.c
> > +++ b/drivers/staging/sm750fb/sm750.c
> > @@ -910,6 +910,7 @@ static void sm750fb_framebuffer_release(struct sm750_dev *sm750_dev)
> >       while (sm750_dev->fb_count) {
> >               fb_info = sm750_dev->fbinfo[sm750_dev->fb_count - 1];
> >               unregister_framebuffer(fb_info);
> > +             fb_dealloc_cmap(&fb_info->cmap);
> >               framebuffer_release(fb_info);
> >               sm750_dev->fb_count--;
> >       }
> > @@ -943,6 +944,7 @@ static int sm750fb_framebuffer_alloc(struct sm750_dev *sm750_dev, int fbidx)
> >       return 0;
> >
> >  release_fb:
> > +     fb_dealloc_cmap(&fb_info->cmap);
> >       framebuffer_release(fb_info);
> >       return err;
> >  }
> > --
> > 2.43.0
> >
> >
>
> Nice, how was this found and tested?
>
> thanks,
>
> greg k-h