drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

[PATCH v1] drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

Posted by Yuho Choi 2 months ago

radeon_ring_restore() takes ownership of the data buffer allocated by
radeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in
the non-restore branch; in the restore branch it relies on
radeon_ring_restore() to free it.

If radeon_ring_lock() fails, the function returned early without calling
kvfree(data), leaking the ring backup buffer on every GPU reset that
fails at the lock stage. During repeated GPU resets this causes
cumulative kernel memory exhaustion.

Free data before returning the error.

Fixes: 55d7c22192be ("drm/radeon: implement ring saving on reset v4")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---
 drivers/gpu/drm/radeon/radeon_ring.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 581ae20c46e4b..a5dff072c1ac0 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -356,8 +356,10 @@ int radeon_ring_restore(struct radeon_device *rdev, struct radeon_ring *ring,
 
 	/* restore the saved ring content */
 	r = radeon_ring_lock(rdev, ring, size);
-	if (r)
+	if (r) {
+		kvfree(data);
 		return r;
+	}
 
 	for (i = 0; i < size; ++i) {
 		radeon_ring_write(ring, data[i]);
-- 
2.50.1 (Apple Git-155)

Re: [PATCH v1] drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

Posted by Alex Deucher 1 month, 4 weeks ago

Applied.  Thanks!

On Fri, Apr 17, 2026 at 3:06 AM Yuho Choi <dbgh9129@gmail.com> wrote:
>
> radeon_ring_restore() takes ownership of the data buffer allocated by
> radeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in
> the non-restore branch; in the restore branch it relies on
> radeon_ring_restore() to free it.
>
> If radeon_ring_lock() fails, the function returned early without calling
> kvfree(data), leaking the ring backup buffer on every GPU reset that
> fails at the lock stage. During repeated GPU resets this causes
> cumulative kernel memory exhaustion.
>
> Free data before returning the error.
>
> Fixes: 55d7c22192be ("drm/radeon: implement ring saving on reset v4")
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
> ---
>  drivers/gpu/drm/radeon/radeon_ring.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
> index 581ae20c46e4b..a5dff072c1ac0 100644
> --- a/drivers/gpu/drm/radeon/radeon_ring.c
> +++ b/drivers/gpu/drm/radeon/radeon_ring.c
> @@ -356,8 +356,10 @@ int radeon_ring_restore(struct radeon_device *rdev, struct radeon_ring *ring,
>
>         /* restore the saved ring content */
>         r = radeon_ring_lock(rdev, ring, size);
> -       if (r)
> +       if (r) {
> +               kvfree(data);
>                 return r;
> +       }
>
>         for (i = 0; i < size; ++i) {
>                 radeon_ring_write(ring, data[i]);
> --
> 2.50.1 (Apple Git-155)
>

Re: [PATCH v1] drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

Posted by 최유호 1 month, 4 weeks ago

Dear Alex,

Thank you for applying the patch.

Best regards,
Yuho Choi

On Fri, 17 Apr 2026 at 10:05, Alex Deucher <alexdeucher@gmail.com> wrote:
>
> Applied.  Thanks!
>
> On Fri, Apr 17, 2026 at 3:06 AM Yuho Choi <dbgh9129@gmail.com> wrote:
> >
> > radeon_ring_restore() takes ownership of the data buffer allocated by
> > radeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in
> > the non-restore branch; in the restore branch it relies on
> > radeon_ring_restore() to free it.
> >
> > If radeon_ring_lock() fails, the function returned early without calling
> > kvfree(data), leaking the ring backup buffer on every GPU reset that
> > fails at the lock stage. During repeated GPU resets this causes
> > cumulative kernel memory exhaustion.
> >
> > Free data before returning the error.
> >
> > Fixes: 55d7c22192be ("drm/radeon: implement ring saving on reset v4")
> > Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
> > ---
> >  drivers/gpu/drm/radeon/radeon_ring.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
> > index 581ae20c46e4b..a5dff072c1ac0 100644
> > --- a/drivers/gpu/drm/radeon/radeon_ring.c
> > +++ b/drivers/gpu/drm/radeon/radeon_ring.c
> > @@ -356,8 +356,10 @@ int radeon_ring_restore(struct radeon_device *rdev, struct radeon_ring *ring,
> >
> >         /* restore the saved ring content */
> >         r = radeon_ring_lock(rdev, ring, size);
> > -       if (r)
> > +       if (r) {
> > +               kvfree(data);
> >                 return r;
> > +       }
> >
> >         for (i = 0; i < size; ++i) {
> >                 radeon_ring_write(ring, data[i]);
> > --
> > 2.50.1 (Apple Git-155)
> >