2019-06-21 22:37:16

by Colin King

Subject: [PATCH] drm/vmwgfx: fix memory leak when too many retries have occurred

From: Colin Ian King <[email protected]>

Currently when too many retries have occurred there is a memory
leak on the allocation for reply on the error return path. Fix
this by kfree'ing reply before returning.

Addresses-Coverity: ("Resource leak")
Fixes: a9cd9c044aa9 ("drm/vmwgfx: Add a check to handle host message failure")
Signed-off-by: Colin Ian King <[email protected]>
---
drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
index 8b9270f31409..8b61f16f50cf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
@@ -301,8 +301,10 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
break;
}

- if (retries == RETRIES)
+ if (retries == RETRIES) {
+ kfree(reply);
return -EINVAL;
+ }

*msg_len = reply_len;
*msg = reply;
--
2.20.1

2019-06-24 19:58:52

by Deepak Singh Rawat

Subject: Re: [PATCH] drm/vmwgfx: fix memory leak when too many retries have occurred

Hi Colin,

Thanks for doing this.

Reviewed-by: Deepak Rawat <[email protected]>

Do you want me to include this in vmwgfx-next or will you submit this
via drm-mics?

On Fri, 2019-06-21 at 23:35 +0100, Colin King wrote:
> From: Colin Ian King <[email protected]>
>
> Currently when too many retries have occurred there is a memory
> leak on the allocation for reply on the error return path. Fix
> this by kfree'ing reply before returning.
>
> Addresses-Coverity: ("Resource leak")
> Fixes: a9cd9c044aa9 ("drm/vmwgfx: Add a check to handle host message
> failure")
> Signed-off-by: Colin Ian King <[email protected]>
> ---
> drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> index 8b9270f31409..8b61f16f50cf 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> @@ -301,8 +301,10 @@ static int vmw_recv_msg(struct rpc_channel
> *channel, void **msg,
> break;
> }
>
> - if (retries == RETRIES)
> + if (retries == RETRIES) {
> + kfree(reply);
> return -EINVAL;
> + }
>
> *msg_len = reply_len;
> *msg = reply;

2019-06-24 20:00:38

by Colin King

Subject: Re: [PATCH] drm/vmwgfx: fix memory leak when too many retries have occurred

On 24/06/2019 17:10, Deepak Singh Rawat wrote:
> Hi Colin,
>
> Thanks for doing this.
>
> Reviewed-by: Deepak Rawat <[email protected]>
>
> Do you want me to include this in vmwgfx-next or will you submit this
> via drm-mics?

Can you include it into vmwgfx-next?

Thanks

Colin

>
> On Fri, 2019-06-21 at 23:35 +0100, Colin King wrote:
>> From: Colin Ian King <[email protected]>
>>
>> Currently when too many retries have occurred there is a memory
>> leak on the allocation for reply on the error return path. Fix
>> this by kfree'ing reply before returning.
>>
>> Addresses-Coverity: ("Resource leak")
>> Fixes: a9cd9c044aa9 ("drm/vmwgfx: Add a check to handle host message
>> failure")
>> Signed-off-by: Colin Ian King <[email protected]>
>> ---
>> drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 4 +++-
>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
>> b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
>> index 8b9270f31409..8b61f16f50cf 100644
>> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
>> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
>> @@ -301,8 +301,10 @@ static int vmw_recv_msg(struct rpc_channel
>> *channel, void **msg,
>> break;
>> }
>>
>> - if (retries == RETRIES)
>> + if (retries == RETRIES) {
>> + kfree(reply);
>> return -EINVAL;
>> + }
>>
>> *msg_len = reply_len;
>> *msg = reply;
>