tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/nouveau/gsp: fix potential leak of memory used during acpi init

If any of the ACPI calls fail, memory allocated for the input buffer
would be leaked. Fix failure paths to free allocated memory.

Also add checks to ensure the allocations succeeded in the first place.

Reported-by: Danilo Krummrich <dakr@kernel.org>
Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM")
Signed-off-by: Ben Skeggs <bskeggs@nvidia.com>
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Link: https://lore.kernel.org/r/20250617040036.2932-1-bskeggs@nvidia.com

authored by

Ben Skeggs and committed by
Danilo Krummrich d133036a 3d441474

+14 -6
+14 -6
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c
··· 719 719 union acpi_object argv4 = { 720 720 .buffer.type = ACPI_TYPE_BUFFER, 721 721 .buffer.length = 4, 722 - .buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL), 723 722 }, *obj; 724 723 725 724 caps->status = 0xffff; ··· 726 727 if (!acpi_check_dsm(handle, &NVOP_DSM_GUID, NVOP_DSM_REV, BIT_ULL(0x1a))) 727 728 return; 728 729 730 + argv4.buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL); 731 + if (!argv4.buffer.pointer) 732 + return; 733 + 729 734 obj = acpi_evaluate_dsm(handle, &NVOP_DSM_GUID, NVOP_DSM_REV, 0x1a, &argv4); 730 735 if (!obj) 731 - return; 736 + goto done; 732 737 733 738 if (WARN_ON(obj->type != ACPI_TYPE_BUFFER) || 734 739 WARN_ON(obj->buffer.length != 4)) 735 - return; 740 + goto done; 736 741 737 742 caps->status = 0; 738 743 caps->optimusCaps = *(u32 *)obj->buffer.pointer; 739 744 745 + done: 740 746 ACPI_FREE(obj); 741 747 742 748 kfree(argv4.buffer.pointer); ··· 758 754 union acpi_object argv4 = { 759 755 .buffer.type = ACPI_TYPE_BUFFER, 760 756 .buffer.length = sizeof(caps), 761 - .buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL), 762 757 }, *obj; 763 758 764 759 jt->status = 0xffff; 765 760 761 + argv4.buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL); 762 + if (!argv4.buffer.pointer) 763 + return; 764 + 766 765 obj = acpi_evaluate_dsm(handle, &JT_DSM_GUID, JT_DSM_REV, 0x1, &argv4); 767 766 if (!obj) 768 - return; 767 + goto done; 769 768 770 769 if (WARN_ON(obj->type != ACPI_TYPE_BUFFER) || 771 770 WARN_ON(obj->buffer.length != 4)) 772 - return; 771 + goto done; 773 772 774 773 jt->status = 0; 775 774 jt->jtCaps = *(u32 *)obj->buffer.pointer; 776 775 jt->jtRevId = (jt->jtCaps & 0xfff00000) >> 20; 777 776 jt->bSBIOSCaps = 0; 778 777 778 + done: 779 779 ACPI_FREE(obj); 780 780 781 781 kfree(argv4.buffer.pointer);