Re: [PATCH v1] drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

[Alex Deucher]

Applied.  Thanks!

On Fri, Apr 17, 2026 at 3:06 AM Yuho Choi <dbgh9129@xxxxxxxxx> wrote:
>
> radeon_ring_restore() takes ownership of the data buffer allocated by
> radeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in
> the non-restore branch; in the restore branch it relies on
> radeon_ring_restore() to free it.
>
> If radeon_ring_lock() fails, the function returned early without calling
> kvfree(data), leaking the ring backup buffer on every GPU reset that
> fails at the lock stage. During repeated GPU resets this causes
> cumulative kernel memory exhaustion.
>
> Free data before returning the error.
>
> Fixes: 55d7c22192be ("drm/radeon: implement ring saving on reset v4")
> Signed-off-by: Yuho Choi <dbgh9129@xxxxxxxxx>
> ---
>  drivers/gpu/drm/radeon/radeon_ring.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
> index 581ae20c46e4b..a5dff072c1ac0 100644
> --- a/drivers/gpu/drm/radeon/radeon_ring.c
> +++ b/drivers/gpu/drm/radeon/radeon_ring.c
> @@ -356,8 +356,10 @@ int radeon_ring_restore(struct radeon_device *rdev, struct radeon_ring *ring,
>
>         /* restore the saved ring content */
>         r = radeon_ring_lock(rdev, ring, size);
> -       if (r)
> +       if (r) {
> +               kvfree(data);
>                 return r;
> +       }
>
>         for (i = 0; i < size; ++i) {
>                 radeon_ring_write(ring, data[i]);
> --
> 2.50.1 (Apple Git-155)
>