2023-12-04 09:15:04

by Zhipeng Lu

Subject: [PATCH] [v2] drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node

When ida_alloc_max fails, resources allocated before should be freed,
including *res allocated by kmalloc and ttm_resource_init.

Fixes: d3bcb4b02fe9 ("drm/vmwgfx: switch the TTM backends to self alloc")
Signed-off-by: Zhipeng Lu <[email protected]>
---

Changelog:

v2: Adding {} to correct the if statement
---
drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
index ceb4d3d3b965..a0b47c9b33f5 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
@@ -64,8 +64,11 @@ static int vmw_gmrid_man_get_node(struct ttm_resource_manager *man,
ttm_resource_init(bo, place, *res);

id = ida_alloc_max(&gman->gmr_ida, gman->max_gmr_ids - 1, GFP_KERNEL);
- if (id < 0)
+ if (id < 0) {
+ ttm_resource_fini(man, *res);
+ kfree(*res);
return id;
+ }

spin_lock(&gman->lock);

--
2.34.1

2024-01-04 03:28:44

by Zack Rusin

Subject: Re: [PATCH] [v2] drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node

On Mon, Dec 4, 2023 at 4:15 AM Zhipeng Lu <[email protected]> wrote:
>
> When ida_alloc_max fails, resources allocated before should be freed,
> including *res allocated by kmalloc and ttm_resource_init.
>
> Fixes: d3bcb4b02fe9 ("drm/vmwgfx: switch the TTM backends to self alloc")
> Signed-off-by: Zhipeng Lu <[email protected]>
> ---
>
> Changelog:
>
> v2: Adding {} to correct the if statement
> ---
> drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
> index ceb4d3d3b965..a0b47c9b33f5 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
> @@ -64,8 +64,11 @@ static int vmw_gmrid_man_get_node(struct ttm_resource_manager *man,
> ttm_resource_init(bo, place, *res);
>
> id = ida_alloc_max(&gman->gmr_ida, gman->max_gmr_ids - 1, GFP_KERNEL);
> - if (id < 0)
> + if (id < 0) {
> + ttm_resource_fini(man, *res);
> + kfree(*res);
> return id;
> + }
>
> spin_lock(&gman->lock);

Thanks, I pushed it to drm-misc-next.

z