nouveau/gsp: fix memory leak in r535_gsp_acpi_dod() unwind paths

PATCH New Danilo Krummrich 1 participant 1 message Feb 16

Subsystems (4)

Stable branch DRM drivers DRM misc nouveau

lore

Share & tools

lore

Danilo Krummrich

author maintainer

2026-02-16 22:09 UTC #0 lore raw

PATCH 1/1 nouveau/gsp: fix memory leak in r535_gsp_acpi_dod() unwind paths

acpi_evaluate_object() allocates the output buffer when called with ACPI_ALLOCATE_BUFFER.

Subsequent unwind path do not free the ACPI object however, hence fix it.

Fixes 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM")

Fixes a9b9b42b54b2 ("nouveau/gsp: free acpi object after use")

Cc [email protected]

Signed-off-by Danilo Krummrich <[email protected]>

---
 drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c +3 -2

index a575a8dbf727..214ce78b0645 100644
@@ -863,17 +863,18 @@ r535_gsp_acpi_dod(acpi_handle handle, DOD_METHOD_DATA *dod)
 
 	if (_DOD->type != ACPI_TYPE_PACKAGE ||
 	    _DOD->package.count > ARRAY_SIZE(dod->acpiIdList))
-		return;
+		goto out_free;
 
 	for (int i = 0; i < _DOD->package.count; i++) {
 		if (WARN_ON(_DOD->package.elements[i].type != ACPI_TYPE_INTEGER))
-			return;
+			goto out_free;
 
 		dod->acpiIdList[i] = _DOD->package.elements[i].integer.value;
 		dod->acpiIdListLen += sizeof(dod->acpiIdList[0]);
 	}
 
 	dod->status = 0;
+out_free:
 	kfree(output.pointer);
 }
 #endif

base-commit: 9478c166c46934160135e197b049b5a05753f2ad

Signature · 1 line

2.53.0