diff mbox series

Memory leak fix

Message ID 20201002045215.32266-1-steven.t.hampson@intel.com (mailing list archive)
State New, archived
Headers show
Series Memory leak fix | expand

Commit Message

Steve Hampson Oct. 2, 2020, 4:52 a.m. UTC
Static analysis detected a memory leak if the second kmalloc fails
and the first allocation is not freed.

Signed-off-by: Steve Hampson <steven.t.hampson@intel.com>
---
 drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Chris Wilson Oct. 2, 2020, 8:21 a.m. UTC | #1
Quoting Steve Hampson (2020-10-02 05:52:15)
> Static analysis detected a memory leak if the second kmalloc fails
> and the first allocation is not freed.
> 
> Signed-off-by: Steve Hampson <steven.t.hampson@intel.com>
> ---
>  drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
> index 12b30075134a..c8be7534a2fb 100644
> --- a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
> +++ b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
> @@ -234,8 +234,10 @@ i915_gem_userptr_init__mmu_notifier(struct drm_i915_gem_object *obj,
>                 return PTR_ERR(mn);
>  
>         mo = kzalloc(sizeof(*mo), GFP_KERNEL);
> -       if (!mo)
> +       if (!mo) {
> +               kfree(mn);

mn is still being referenced by mm->mn and mmu_notifiers here.
It will be released along with the mm when all objects drop their ref to
obj->userptr.mm, which includes after this error.
-Chris
diff mbox series

Patch

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
index 12b30075134a..c8be7534a2fb 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
@@ -234,8 +234,10 @@  i915_gem_userptr_init__mmu_notifier(struct drm_i915_gem_object *obj,
 		return PTR_ERR(mn);
 
 	mo = kzalloc(sizeof(*mo), GFP_KERNEL);
-	if (!mo)
+	if (!mo) {
+		kfree(mn);
 		return -ENOMEM;
+	}
 
 	mo->mn = mn;
 	mo->obj = obj;