linux-kernel - [PATCH] drm/nouveau/gr/ga102: Fix memory leak in ga102_gr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20260126112013.117318-1-zilin@seu.edu.cn>
Date: Mon, 26 Jan 2026 11:20:13 +0000
From: Zilin Guan <zilin@....edu.cn>
To: lyude@...hat.com
Cc: dakr@...nel.org,
	maarten.lankhorst@...ux.intel.com,
	mripard@...nel.org,
	tzimmermann@...e.de,
	airlied@...il.com,
	simona@...ll.ch,
	skeggs@...dia.com,
	gsamaiya@...dia.com,
	dri-devel@...ts.freedesktop.org,
	nouveau@...ts.freedesktop.org,
	linux-kernel@...r.kernel.org,
	jianhao.xu@....edu.cn,
	Zilin Guan <zilin@....edu.cn>
Subject: [PATCH] drm/nouveau/gr/ga102: Fix memory leak in ga102_gr_load()

The ga102_gr_load() function loads firmware using nvkm_firmware_get().
If nvkm_acr_lsfw_load_bl_sig_net() fails for either FECS or GPCCS,
the function returns without releasing the firmware, resulting in a
memory leak.

Change the error paths to goto out_free to ensure nvkm_firmware_put()
is called to release the firmware.

Compile tested only. Issue found using a prototype static analysis tool
and code review.

Fixes: c4bdac754ca0 ("drm/nouveau/gr/ga102: initial support")
Signed-off-by: Zilin Guan <zilin@....edu.cn>
---
 drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c
index 2b51f1d0c281..4338777506db 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c
@@ -324,7 +324,7 @@ ga102_gr_load(struct gf100_gr *gr, int ver, const struct gf100_gr_fwif *fwif)
 					    fw->data + fecs_data->data_offset,
 						       fecs_data->data_size);
 	if (ret)
-		return ret;
+		goto out_free;
 
 	ret = nvkm_acr_lsfw_load_bl_sig_net(subdev, &gr->gpccs.falcon, NVKM_ACR_LSF_GPCCS,
 					    "gr/gpccs_", ver, fwif->gpccs,
@@ -333,12 +333,13 @@ ga102_gr_load(struct gf100_gr *gr, int ver, const struct gf100_gr_fwif *fwif)
 					    fw->data + gpccs_data->data_offset,
 						       gpccs_data->data_size);
 	if (ret)
-		return ret;
+		goto out_free;
 
 	gr->firmware = true;
 
+out_free:
 	nvkm_firmware_put(fw);
-	return 0;
+	return ret;
 }
 
 static const struct gf100_gr_fwif
-- 
2.34.1