amdgpu_acpi_enumerate_xcc() looks up each XCC ACPI device with
acpi_dev_get_first_match_dev(), which takes a reference to the device.
The reference is dropped with acpi_dev_put() after the XCC info is
initialized, but if the kzalloc_obj() allocation of the XCC info fails
the function returns -ENOMEM without releasing the reference, leaking
the last reference to the ACPI device.

Drop the ACPI device reference on the allocation failure path before
returning.

Fixes: 4d5275ab0b18 ("drm/amdgpu: Add parsing of acpi xcc objects")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 516ab9cf88fc..8d3f1f5a141e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1167,8 +1167,10 @@ int amdgpu_acpi_enumerate_xcc(void)
 		}
 
 		xcc_info = kzalloc_obj(struct amdgpu_acpi_xcc_info);
-		if (!xcc_info)
+		if (!xcc_info) {
+			acpi_dev_put(acpi_dev);
 			return -ENOMEM;
+		}
 
 		INIT_LIST_HEAD(&xcc_info->list);
 		xcc_info->handle = acpi_device_handle(acpi_dev);
-- 
2.34.1

On 16-Sep-26 3:24 PM, Wentao Liang wrote:
> amdgpu_acpi_enumerate_xcc() looks up each XCC ACPI device with
> acpi_dev_get_first_match_dev(), which takes a reference to the device.
> The reference is dropped with acpi_dev_put() after the XCC info is
> initialized, but if the kzalloc_obj() allocation of the XCC info fails
> the function returns -ENOMEM without releasing the reference, leaking
> the last reference to the ACPI device.
> 
> Drop the ACPI device reference on the allocation failure path before
> returning.
> 
> Fixes: 4d5275ab0b18 ("drm/amdgpu: Add parsing of acpi xcc objects")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>

Thanks,
Lijo

> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
> index 516ab9cf88fc..8d3f1f5a141e 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
> @@ -1167,8 +1167,10 @@ int amdgpu_acpi_enumerate_xcc(void)
>   		}
>   
>   		xcc_info = kzalloc_obj(struct amdgpu_acpi_xcc_info);
> -		if (!xcc_info)
> +		if (!xcc_info) {
> +			acpi_dev_put(acpi_dev);
>   			return -ENOMEM;
> +		}
>   
>   		INIT_LIST_HEAD(&xcc_info->list);
>   		xcc_info->handle = acpi_device_handle(acpi_dev);