Re: [PATCH v1] drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

[최유호]

Dear Alex,

Thank you for applying the patch.

Best regards,
Yuho Choi

On Fri, 17 Apr 2026 at 10:05, Alex Deucher <alexdeucher@xxxxxxxxx> wrote:
>
> Applied.  Thanks!
>
> On Fri, Apr 17, 2026 at 3:06 AM Yuho Choi <dbgh9129@xxxxxxxxx> wrote:
> >
> > radeon_ring_restore() takes ownership of the data buffer allocated by
> > radeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in
> > the non-restore branch; in the restore branch it relies on
> > radeon_ring_restore() to free it.
> >
> > If radeon_ring_lock() fails, the function returned early without calling
> > kvfree(data), leaking the ring backup buffer on every GPU reset that
> > fails at the lock stage. During repeated GPU resets this causes
> > cumulative kernel memory exhaustion.
> >
> > Free data before returning the error.
> >
> > Fixes: 55d7c22192be ("drm/radeon: implement ring saving on reset v4")
> > Signed-off-by: Yuho Choi <dbgh9129@xxxxxxxxx>
> > ---
> >  drivers/gpu/drm/radeon/radeon_ring.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
> > index 581ae20c46e4b..a5dff072c1ac0 100644
> > --- a/drivers/gpu/drm/radeon/radeon_ring.c
> > +++ b/drivers/gpu/drm/radeon/radeon_ring.c
> > @@ -356,8 +356,10 @@ int radeon_ring_restore(struct radeon_device *rdev, struct radeon_ring *ring,
> >
> >         /* restore the saved ring content */
> >         r = radeon_ring_lock(rdev, ring, size);
> > -       if (r)
> > +       if (r) {
> > +               kvfree(data);
> >                 return r;
> > +       }
> >
> >         for (i = 0; i < size; ++i) {
> >                 radeon_ring_write(ring, data[i]);
> > --
> > 2.50.1 (Apple Git-155)
> >