Nouveau - Jun 2016 - [PATCH] drm/nouveau/iccsense: fix memory leak

In the for loop we are allocating the memory for rail everytime but
in some cases we use "continue" and in those cases the memory already
allocated for rail is leaked and we again allocate new memory for it.
Lets free the memory before continuing with the loop.

Signed-off-by: Sudip Mukherjee <sudip.mukherjee at codethink.co.uk>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c
b/drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c
index 323c79a..756ff07 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c
@@ -290,21 +290,28 @@ nvkm_iccsense_oneinit(struct nvkm_subdev *subdev)
 
 		switch (sensor->type) {
 		case NVBIOS_EXTDEV_INA209:
-			if (r->rail != 0)
+			if (r->rail != 0) {
+				kfree(rail);
 				continue;
+			}
 			rail->read = nvkm_iccsense_ina209_read;
 			break;
 		case NVBIOS_EXTDEV_INA219:
-			if (r->rail != 0)
+			if (r->rail != 0) {
+				kfree(rail);
 				continue;
+			}
 			rail->read = nvkm_iccsense_ina219_read;
 			break;
 		case NVBIOS_EXTDEV_INA3221:
-			if (r->rail >= 3)
+			if (r->rail >= 3) {
+				kfree(rail);
 				continue;
+			}
 			rail->read = nvkm_iccsense_ina3221_read;
 			break;
 		default:
+			kfree(rail);
 			continue;
 		}
 
-- 
1.9.1

Thanks. It seems though that you are not the only one who spotted this 
bug. This patch appears to be obsolete since 7505fdf [1].

Roy

[1] 
https://github.com/skeggsb/nouveau/commit/7505fdfc2688e86f8e15069b611858f0dbe73a80

Op 06/12/16 om 15:56 schreef Sudip Mukherjee:
> In the for loop we are allocating the memory for rail everytime but
> in some cases we use "continue" and in those cases the memory
already
> allocated for rail is leaked and we again allocate new memory for it.
> Lets free the memory before continuing with the loop.
>
> Signed-off-by: Sudip Mukherjee <sudip.mukherjee at codethink.co.uk>
> ---
>   drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c | 13 ++++++++++---
>   1 file changed, 10 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c
b/drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c
> index 323c79a..756ff07 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c
> @@ -290,21 +290,28 @@ nvkm_iccsense_oneinit(struct nvkm_subdev *subdev)
>   
>   		switch (sensor->type) {
>   		case NVBIOS_EXTDEV_INA209:
> -			if (r->rail != 0)
> +			if (r->rail != 0) {
> +				kfree(rail);
>   				continue;
> +			}
>   			rail->read = nvkm_iccsense_ina209_read;
>   			break;
>   		case NVBIOS_EXTDEV_INA219:
> -			if (r->rail != 0)
> +			if (r->rail != 0) {
> +				kfree(rail);
>   				continue;
> +			}
>   			rail->read = nvkm_iccsense_ina219_read;
>   			break;
>   		case NVBIOS_EXTDEV_INA3221:
> -			if (r->rail >= 3)
> +			if (r->rail >= 3) {
> +				kfree(rail);
>   				continue;
> +			}
>   			rail->read = nvkm_iccsense_ina3221_read;
>   			break;
>   		default:
> +			kfree(rail);
>   			continue;
>   		}
>