When krealloc() fails, free the original oa_config_ids before returning
to avoid a memory leak.

Fixes: 4f6ccc74a85c ("drm/i915: add support for perf configuration queries")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
---
 drivers/gpu/drm/i915/i915_query.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/i915_query.c b/drivers/gpu/drm/i915/i915_query.c
index 0c55fb6e9727..11157fb14db3 100644
--- a/drivers/gpu/drm/i915/i915_query.c
+++ b/drivers/gpu/drm/i915/i915_query.c
@@ -403,8 +403,10 @@ static int query_perf_config_list(struct drm_i915_private *i915,
 		ids = krealloc(oa_config_ids,
 			       n_configs * sizeof(*oa_config_ids),
 			       GFP_KERNEL);
-		if (!ids)
+		if (!ids) {
+			kfree(oa_config_ids);
 			return -ENOMEM;
+		}
 
 		alloc = fetch_and_zero(&n_configs);

Hi Thorsten,

On Sun, Aug 23, 2026 at 10:50:28PM +0200, Thorsten Blum wrote:
> When krealloc() fails, free the original oa_config_ids before returning
> to avoid a memory leak.
> 
> Fixes: 4f6ccc74a85c ("drm/i915: add support for perf configuration queries")
> Cc: stable@vger.kernel.org
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>

merged to drm-intel-next.

Thanks,
Andi

Quoting Thorsten Blum (2026-08-23 23:50:28)
> When krealloc() fails, free the original oa_config_ids before returning
> to avoid a memory leak.
> 
> Fixes: 4f6ccc74a85c ("drm/i915: add support for perf configuration queries")
> Cc: stable@vger.kernel.org
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
> ---
>  drivers/gpu/drm/i915/i915_query.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/i915/i915_query.c b/drivers/gpu/drm/i915/i915_query.c
> index 0c55fb6e9727..11157fb14db3 100644
> --- a/drivers/gpu/drm/i915/i915_query.c
> +++ b/drivers/gpu/drm/i915/i915_query.c
> @@ -403,8 +403,10 @@ static int query_perf_config_list(struct drm_i915_private *i915,
>                 ids = krealloc(oa_config_ids,
>                                n_configs * sizeof(*oa_config_ids),
>                                GFP_KERNEL);
> -               if (!ids)
> +               if (!ids) {
> +                       kfree(oa_config_ids);
>                         return -ENOMEM;

Instead of duplicating the code once more, could we just refactor into
"goto err_ids;" style to clean up the function?

Regards, Joonas

On Mon, Aug 31, 2026 at 09:39:58AM +0300, Joonas Lahtinen wrote:
> Quoting Thorsten Blum (2026-08-23 23:50:28)
> > When krealloc() fails, free the original oa_config_ids before returning
> > to avoid a memory leak.
> > 
> > Fixes: 4f6ccc74a85c ("drm/i915: add support for perf configuration queries")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
> > ---
> >  drivers/gpu/drm/i915/i915_query.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/gpu/drm/i915/i915_query.c b/drivers/gpu/drm/i915/i915_query.c
> > index 0c55fb6e9727..11157fb14db3 100644
> > --- a/drivers/gpu/drm/i915/i915_query.c
> > +++ b/drivers/gpu/drm/i915/i915_query.c
> > @@ -403,8 +403,10 @@ static int query_perf_config_list(struct drm_i915_private *i915,
> >                 ids = krealloc(oa_config_ids,
> >                                n_configs * sizeof(*oa_config_ids),
> >                                GFP_KERNEL);
> > -               if (!ids)
> > +               if (!ids) {
> > +                       kfree(oa_config_ids);
> >                         return -ENOMEM;
> 
> Instead of duplicating the code once more, could we just refactor into
> "goto err_ids;" style to clean up the function?
> 
> Regards, Joonas

I think the cleanup should be a separate patch, since this minimal fix
should make it easier to backport to stable.

Thanks,
Thorsten

Hi Thorsten,

On Sun, Aug 23, 2026 at 10:50:28PM +0200, Thorsten Blum wrote:
> When krealloc() fails, free the original oa_config_ids before returning
> to avoid a memory leak.
> 
> Fixes: 4f6ccc74a85c ("drm/i915: add support for perf configuration queries")
> Cc: stable@vger.kernel.org
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>

Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>

Thanks,
Andi