From 615f6c0322bc2b3a006ee4e645b5d854f98c3747 Mon Sep 17 00:00:00 2001 From: Elliot Chen Date: Mon, 25 May 2026 11:58:53 +0900 Subject: [PATCH] backend-pipewire: fix dmabuf memory leak on renderbuffer creation failure When create_renderbuffer_dmabuf() fails and returns NULL, the previously allocated linux_dmabuf_memory was leaked because pipewire_output_setup_dmabuf() had already been called with no cleanup path. Reorder the calls so that create_renderbuffer_dmabuf() is invoked first. If it fails, explicitly destroy linux_dmabuf_memory and return early to avoid the leak. Signed-off-by: Elliot Chen --- libweston/backend-pipewire/pipewire.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/libweston/backend-pipewire/pipewire.c b/libweston/backend-pipewire/pipewire.c index 9921f958b..82695672a 100644 --- a/libweston/backend-pipewire/pipewire.c +++ b/libweston/backend-pipewire/pipewire.c @@ -745,13 +745,24 @@ pipewire_output_stream_add_buffer(void *data, struct pw_buffer *buffer) "failed to allocate DMABUF buffer"); return; } - pipewire_output_setup_dmabuf(output, buffer, dmabuf); frame_data->renderbuffer = renderer->create_renderbuffer_dmabuf(&output->base, dmabuf->linux_dmabuf_memory, NULL, NULL); + /* If rendererbuffer is NULL, the linux_dmabuf_memory + * must be released explicitly here. + */ + if (!frame_data->renderbuffer) { + dmabuf->linux_dmabuf_memory->destroy (dmabuf->linux_dmabuf_memory); + pipewire_destroy_dmabuf(output, dmabuf); + pw_stream_set_error(output->stream, -ENOMEM, + "failed to allocate renderbuffer"); + return; + } + frame_data->dmabuf = dmabuf; + pipewire_output_setup_dmabuf(output, buffer, dmabuf); } else if (buffertype & (1u << SPA_DATA_MemFd)) { const struct pixel_format_info *format = output->pixel_format; int stride = output->base.current_mode->width * format->bpp / 8;