1. Patchew
  2. linux
  3. View series

[PATCH] drm/vc4: fix krealloc() memory leak

Alexander A. Klimov posted 1 patch 1 week, 6 days ago
There is a newer version of this series
drivers/gpu/drm/vc4/vc4_validate_shaders.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
[PATCH] drm/vc4: fix krealloc() memory leak
Posted by Alexander A. Klimov 1 week, 6 days ago 
Don't just overwrite the original pointer passed to krealloc()
with its return value without checking latter:

    MEM = krealloc(MEM, SZ, GFP);

If krealloc() returns NULL, that erases the pointer
to the still allocated memory, hence leaks this memory.
Instead, use a temporary variable, check it's not NULL
and only then assign it to the original pointer:

    TMP = krealloc(MEM, SZ, GFP);
    if (!TMP) return;
    MEM = TMP;

Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 drivers/gpu/drm/vc4/vc4_validate_shaders.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
index d48cf76983c0..af48758592f9 100644
--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
@@ -291,14 +291,14 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
 	uint32_t o = validated_shader->num_uniform_addr_offsets;
 	uint32_t num_uniforms = validated_shader->uniforms_size / 4;
 
-	validated_shader->uniform_addr_offsets =
-		krealloc(validated_shader->uniform_addr_offsets,
-			 (o + 1) *
-			 sizeof(*validated_shader->uniform_addr_offsets),
-			 GFP_KERNEL);
-	if (!validated_shader->uniform_addr_offsets)
+	void *mem = krealloc(validated_shader->uniform_addr_offsets,
+			     (o + 1) *
+			     sizeof(*validated_shader->uniform_addr_offsets),
+			     GFP_KERNEL);
+	if (!mem)
 		return false;
 
+	validated_shader->uniform_addr_offsets = mem;
 	validated_shader->uniform_addr_offsets[o] = num_uniforms;
 	validated_shader->num_uniform_addr_offsets++;
 
-- 
2.54.0
Re: [PATCH] drm/vc4: fix krealloc() memory leak
Posted by Maíra Canal 1 week, 4 days ago 
Hi Alexander,

LGTM, but a small styling nit:

On 26/05/26 15:41, Alexander A. Klimov wrote:
> Don't just overwrite the original pointer passed to krealloc()
> with its return value without checking latter:
> 
>      MEM = krealloc(MEM, SZ, GFP);
> 
> If krealloc() returns NULL, that erases the pointer
> to the still allocated memory, hence leaks this memory.
> Instead, use a temporary variable, check it's not NULL
> and only then assign it to the original pointer:
> 
>      TMP = krealloc(MEM, SZ, GFP);
>      if (!TMP) return;
>      MEM = TMP;
> 
> Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
> ---
>   drivers/gpu/drm/vc4/vc4_validate_shaders.c | 12 ++++++------
>   1 file changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
> index d48cf76983c0..af48758592f9 100644
> --- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
> +++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
> @@ -291,14 +291,14 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
>   	uint32_t o = validated_shader->num_uniform_addr_offsets;
>   	uint32_t num_uniforms = validated_shader->uniforms_size / 4;

Declare the variable here.

>   
> -	validated_shader->uniform_addr_offsets =
> -		krealloc(validated_shader->uniform_addr_offsets,
> -			 (o + 1) *
> -			 sizeof(*validated_shader->uniform_addr_offsets),
> -			 GFP_KERNEL);
> -	if (!validated_shader->uniform_addr_offsets)
> +	void *mem = krealloc(validated_shader->uniform_addr_offsets,

Instead of void *, you should probably use uint32_t *.

Best regards,
- Maíra

> +			     (o + 1) *
> +			     sizeof(*validated_shader->uniform_addr_offsets),
> +			     GFP_KERNEL);
> +	if (!mem)
>   		return false;
>   
> +	validated_shader->uniform_addr_offsets = mem;
>   	validated_shader->uniform_addr_offsets[o] = num_uniforms;
>   	validated_shader->num_uniform_addr_offsets++;
>
Re: [PATCH] drm/vc4: fix krealloc() memory leak
Posted by Alexander A. Klimov 1 week, 4 days ago 

On 5/28/26 20:17, Maíra Canal wrote:
> Hi Alexander,
> 
> LGTM, but a small styling nit:
> 
> On 26/05/26 15:41, Alexander A. Klimov wrote:
>> Don't just overwrite the original pointer passed to krealloc()
>> with its return value without checking latter:
>>
>>      MEM = krealloc(MEM, SZ, GFP);
>>
>> If krealloc() returns NULL, that erases the pointer
>> to the still allocated memory, hence leaks this memory.
>> Instead, use a temporary variable, check it's not NULL
>> and only then assign it to the original pointer:
>>
>>      TMP = krealloc(MEM, SZ, GFP);
>>      if (!TMP) return;
>>      MEM = TMP;
>>
>> Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
>> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
>> ---
>>   drivers/gpu/drm/vc4/vc4_validate_shaders.c | 12 ++++++------
>>   1 file changed, 6 insertions(+), 6 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
>> index d48cf76983c0..af48758592f9 100644
>> --- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
>> +++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
>> @@ -291,14 +291,14 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
>>       uint32_t o = validated_shader->num_uniform_addr_offsets;
>>       uint32_t num_uniforms = validated_shader->uniforms_size / 4;
> 
> Declare the variable here.

Strange...
It comes already directly after num_uniforms, doesn't it?
At least when I apply my patch to Linus' master.
Re: [PATCH] drm/vc4: fix krealloc() memory leak
Posted by Maíra Canal 1 week, 4 days ago 
Hi Alexander,

On 28/05/26 15:54, Alexander A. Klimov wrote:
> 
> 
> On 5/28/26 20:17, Maíra Canal wrote:
>> Hi Alexander,
>>
>> LGTM, but a small styling nit:
>>
>> On 26/05/26 15:41, Alexander A. Klimov wrote:
>>> Don't just overwrite the original pointer passed to krealloc()
>>> with its return value without checking latter:
>>>
>>>      MEM = krealloc(MEM, SZ, GFP);
>>>
>>> If krealloc() returns NULL, that erases the pointer
>>> to the still allocated memory, hence leaks this memory.
>>> Instead, use a temporary variable, check it's not NULL
>>> and only then assign it to the original pointer:
>>>
>>>      TMP = krealloc(MEM, SZ, GFP);
>>>      if (!TMP) return;
>>>      MEM = TMP;
>>>
>>> Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader 
>>> validation.")
>>> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
>>> ---
>>>   drivers/gpu/drm/vc4/vc4_validate_shaders.c | 12 ++++++------
>>>   1 file changed, 6 insertions(+), 6 deletions(-)
>>>
>>> diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/ 
>>> gpu/drm/vc4/vc4_validate_shaders.c
>>> index d48cf76983c0..af48758592f9 100644
>>> --- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
>>> +++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
>>> @@ -291,14 +291,14 @@ static bool 
>>> require_uniform_address_uniform(struct vc4_validated_shader_info *va
>>>       uint32_t o = validated_shader->num_uniform_addr_offsets;
>>>       uint32_t num_uniforms = validated_shader->uniforms_size / 4;
>>
>> Declare the variable here.
> 
> Strange...
> It comes already directly after num_uniforms, doesn't it?

Yeah, it does. However, usually, we declare the variables and then we
proceed to the functions. Check, for example, the function
record_texture_sample() in vc4.

Best regards,
- Maíra

> At least when I apply my patch to Linus' master.
[PATCH v2] drm/vc4: fix krealloc() memory leak
Posted by Alexander A. Klimov 1 week ago 
Don't just overwrite the original pointer passed to krealloc()
with its return value without checking latter:

    MEM = krealloc(MEM, SZ, GFP);

If krealloc() returns NULL, that erases the pointer
to the still allocated memory, hence leaks this memory.
Instead, use a temporary variable, check it's not NULL
and only then assign it to the original pointer:

    TMP = krealloc(MEM, SZ, GFP);
    if (!TMP) return;
    MEM = TMP;

Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 v2: Declare the variable explicitly
 v2: Instead of void *, use u32 *
 v2: While on it, enhance variable name

 [✓] scripts/checkpatch.pl --strict
 [✓] allmodconfig compiled (i686, LLVM)
 [✓] localyesconfig booted (IBM T43)

 Note to myself: use --in-reply-to=2b602ec6-d563-4fa0-a0c5-89b97a46abf9@igalia.com

 drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
index d48cf76983c0..6f52b4db9cc9 100644
--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
@@ -290,15 +290,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
 {
 	uint32_t o = validated_shader->num_uniform_addr_offsets;
 	uint32_t num_uniforms = validated_shader->uniforms_size / 4;
+	u32 *offsets;
 
-	validated_shader->uniform_addr_offsets =
-		krealloc(validated_shader->uniform_addr_offsets,
-			 (o + 1) *
-			 sizeof(*validated_shader->uniform_addr_offsets),
-			 GFP_KERNEL);
-	if (!validated_shader->uniform_addr_offsets)
+	offsets = krealloc(validated_shader->uniform_addr_offsets,
+			   (o + 1) *
+			   sizeof(*validated_shader->uniform_addr_offsets),
+			   GFP_KERNEL);
+	if (!offsets)
 		return false;
 
+	validated_shader->uniform_addr_offsets = offsets;
 	validated_shader->uniform_addr_offsets[o] = num_uniforms;
 	validated_shader->num_uniform_addr_offsets++;
 
-- 
2.54.0
Re: [PATCH v2] drm/vc4: fix krealloc() memory leak
Posted by Joe Perches 1 week ago 
On Sun, 2026-05-31 at 21:55 +0200, Alexander A. Klimov wrote:
> Don't just overwrite the original pointer passed to krealloc()
> with its return value without checking latter:
[]
> diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
[]
> @@ -290,15 +290,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
>  {
>  	uint32_t o = validated_shader->num_uniform_addr_offsets;
>  	uint32_t num_uniforms = validated_shader->uniforms_size / 4;
> +	u32 *offsets;
>  
> -	validated_shader->uniform_addr_offsets =
> -		krealloc(validated_shader->uniform_addr_offsets,
> -			 (o + 1) *
> -			 sizeof(*validated_shader->uniform_addr_offsets),
> -			 GFP_KERNEL);
> -	if (!validated_shader->uniform_addr_offsets)
> +	offsets = krealloc(validated_shader->uniform_addr_offsets,
> +			   (o + 1) *
> +			   sizeof(*validated_shader->uniform_addr_offsets),
> +			   GFP_KERNEL);

krealloc_array ?

> +	if (!offsets)
>  		return false;
>  
> +	validated_shader->uniform_addr_offsets = offsets;
>  	validated_shader->uniform_addr_offsets[o] = num_uniforms;
>  	validated_shader->num_uniform_addr_offsets++;
[PATCH v3] drm/vc4: fix krealloc() memory leak
Posted by Alexander A. Klimov 2 days, 7 hours ago 
Don't just overwrite the original pointer passed to krealloc()
with its return value without checking latter:

    MEM = krealloc(MEM, SZ, GFP);

If krealloc() returns NULL, that erases the pointer
to the still allocated memory, hence leaks this memory.
Instead, use a temporary variable, check it's not NULL
and only then assign it to the original pointer:

    TMP = krealloc(MEM, SZ, GFP);
    if (!TMP) return;
    MEM = TMP;

While on it, use krealloc_array().

Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 v2: Declare the variable explicitly
 v2: Instead of void *, use u32 *
 v2: While on it, enhance variable name
 v3: Use krealloc_array()

 [✓] scripts/checkpatch.pl --strict
 [✓] allmodconfig compiled (i686, LLVM)
 [✓] localyesconfig booted (IBM T43)

 Note to myself: use --in-reply-to=e1edeadb7c161580a5cd5c7e642dc1b28db8ee86.camel@perches.com

 drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
index d48cf76983c0..66502a6a4a8e 100644
--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
@@ -290,15 +290,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
 {
 	uint32_t o = validated_shader->num_uniform_addr_offsets;
 	uint32_t num_uniforms = validated_shader->uniforms_size / 4;
+	u32 *offsets;
 
-	validated_shader->uniform_addr_offsets =
-		krealloc(validated_shader->uniform_addr_offsets,
-			 (o + 1) *
-			 sizeof(*validated_shader->uniform_addr_offsets),
-			 GFP_KERNEL);
-	if (!validated_shader->uniform_addr_offsets)
+	offsets = krealloc_array(validated_shader->uniform_addr_offsets,
+				 o + 1,
+				 sizeof(*validated_shader->uniform_addr_offsets),
+				 GFP_KERNEL);
+	if (!offsets)
 		return false;
 
+	validated_shader->uniform_addr_offsets = offsets;
 	validated_shader->uniform_addr_offsets[o] = num_uniforms;
 	validated_shader->num_uniform_addr_offsets++;
 
-- 
2.54.0
Re: [PATCH v3] drm/vc4: fix krealloc() memory leak
Posted by Maíra Canal 2 days, 6 hours ago 
On 06/06/26 09:38, Alexander A. Klimov wrote:
> Don't just overwrite the original pointer passed to krealloc()
> with its return value without checking latter:
> 
>      MEM = krealloc(MEM, SZ, GFP);
> 
> If krealloc() returns NULL, that erases the pointer
> to the still allocated memory, hence leaks this memory.
> Instead, use a temporary variable, check it's not NULL
> and only then assign it to the original pointer:
> 
>      TMP = krealloc(MEM, SZ, GFP);
>      if (!TMP) return;
>      MEM = TMP;
> 
> While on it, use krealloc_array().
> 
> Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>

Reviewed-by: Maíra Canal <mcanal@igalia.com>

Best regards,
- Maíra

> ---
>   v2: Declare the variable explicitly
>   v2: Instead of void *, use u32 *
>   v2: While on it, enhance variable name
>   v3: Use krealloc_array()
> 
>   [✓] scripts/checkpatch.pl --strict
>   [✓] allmodconfig compiled (i686, LLVM)
>   [✓] localyesconfig booted (IBM T43)
> 
>   Note to myself: use --in-reply-to=e1edeadb7c161580a5cd5c7e642dc1b28db8ee86.camel@perches.com
> 
>   drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------
>   1 file changed, 7 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
> index d48cf76983c0..66502a6a4a8e 100644
> --- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
> +++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
> @@ -290,15 +290,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
>   {
>   	uint32_t o = validated_shader->num_uniform_addr_offsets;
>   	uint32_t num_uniforms = validated_shader->uniforms_size / 4;
> +	u32 *offsets;
>   
> -	validated_shader->uniform_addr_offsets =
> -		krealloc(validated_shader->uniform_addr_offsets,
> -			 (o + 1) *
> -			 sizeof(*validated_shader->uniform_addr_offsets),
> -			 GFP_KERNEL);
> -	if (!validated_shader->uniform_addr_offsets)
> +	offsets = krealloc_array(validated_shader->uniform_addr_offsets,
> +				 o + 1,
> +				 sizeof(*validated_shader->uniform_addr_offsets),
> +				 GFP_KERNEL);
> +	if (!offsets)
>   		return false;
>   
> +	validated_shader->uniform_addr_offsets = offsets;
>   	validated_shader->uniform_addr_offsets[o] = num_uniforms;
>   	validated_shader->num_uniform_addr_offsets++;
>

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.