Re: [PATCH] drm/vmwgfx: fix memory leak when too many retries have occurred

[Deepak Singh Rawat]

Hi Colin,

Thanks for doing this.

Reviewed-by: Deepak Rawat <drawat@xxxxxxxxxx>

Do you want me to include this in vmwgfx-next or will you submit this
via drm-mics?

On Fri, 2019-06-21 at 23:35 +0100, Colin King wrote:
> From: Colin Ian King <colin.king@xxxxxxxxxxxxx>
> 
> Currently when too many retries have occurred there is a memory
> leak on the allocation for reply on the error return path. Fix
> this by kfree'ing reply before returning.
> 
> Addresses-Coverity: ("Resource leak")
> Fixes: a9cd9c044aa9 ("drm/vmwgfx: Add a check to handle host message
> failure")
> Signed-off-by: Colin Ian King <colin.king@xxxxxxxxxxxxx>
> ---
>  drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> index 8b9270f31409..8b61f16f50cf 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> @@ -301,8 +301,10 @@ static int vmw_recv_msg(struct rpc_channel
> *channel, void **msg,
>  		break;
>  	}
>  
> -	if (retries == RETRIES)
> +	if (retries == RETRIES) {
> +		kfree(reply);
>  		return -EINVAL;
> +	}
>  
>  	*msg_len = reply_len;
>  	*msg     = reply;