[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4ca70a236502a2359b8ba332919b1fe4f9f09010.camel@nvidia.com>
Date: Tue, 12 Aug 2025 22:52:07 +0000
From: Timur Tabi <ttabi@...dia.com>
To: "rongqianfeng@...o.com" <rongqianfeng@...o.com>, "airlied@...hat.com"
<airlied@...hat.com>, "simona@...ll.ch" <simona@...ll.ch>, "lyude@...hat.com"
<lyude@...hat.com>, "dri-devel@...ts.freedesktop.org"
<dri-devel@...ts.freedesktop.org>, Zhi Wang <zhiw@...dia.com>,
"nouveau@...ts.freedesktop.org" <nouveau@...ts.freedesktop.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"dakr@...nel.org" <dakr@...nel.org>
Subject: Re: [PATCH] drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()
On Mon, 2025-08-11 at 17:19 +0800, Qianfeng Rong wrote:
> Replace kfree() with kvfree() for memory allocated by kvmalloc().
>
> Compile-tested only.
>
> Signed-off-by: Qianfeng Rong <rongqianfeng@...o.com>
Reviewed-by: Timur Tabi <ttabi@...dia.com>
This does fix a real bug.
However, I think the real problem is that it's really confusing that
r535_gsp_msgq_recv_one_elem(gsp, &info) returns info.gsp_rpc_buf instead of just success/failure.
r535_gsp_msgq_recv() does this:
buf = kvmalloc(max_t(u32, rpc->length, expected), GFP_KERNEL);
...
info.gsp_rpc_buf = buf;
...
buf = r535_gsp_msgq_recv_one_elem(gsp, &info);
You wouldn't know it, but this does not change the value of 'buf' unless
r535_gsp_msgq_recv_one_elem() fails. If it does fail, the code does this:
if (IS_ERR(buf)) {
kvfree(info.gsp_rpc_buf);
It would be a lot clearer if we could kvfree(buf) here, but we can't because 'buf' no longer points
to the buffer, even though the buffer still exists.
Powered by blists - more mailing lists