Nouveau - Aug 2025 - [PATCH] drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()

Replace kfree() with kvfree() for memory allocated by kvmalloc().

Compile-tested only.

Signed-off-by: Qianfeng Rong <rongqianfeng at vivo.com>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c
b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c
index 9d06ff722fea..0dc4782df8c0 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c
@@ -325,7 +325,7 @@ r535_gsp_msgq_recv(struct nvkm_gsp *gsp, u32 gsp_rpc_len,
int *retries)
 
 		rpc = r535_gsp_msgq_peek(gsp, sizeof(*rpc), info.retries);
 		if (IS_ERR_OR_NULL(rpc)) {
-			kfree(buf);
+			kvfree(buf);
 			return rpc;
 		}
 
@@ -334,7 +334,7 @@ r535_gsp_msgq_recv(struct nvkm_gsp *gsp, u32 gsp_rpc_len,
int *retries)
 
 		rpc = r535_gsp_msgq_recv_one_elem(gsp, &info);
 		if (IS_ERR_OR_NULL(rpc)) {
-			kfree(buf);
+			kvfree(buf);
 			return rpc;
 		}
 
-- 
2.34.1

On Mon, 2025-08-11 at 17:19 +0800, Qianfeng Rong wrote:
> Replace kfree() with kvfree() for memory allocated by kvmalloc().
> 
> Compile-tested only.
> 
> Signed-off-by: Qianfeng Rong <rongqianfeng at vivo.com>
Reviewed-by: Timur Tabi <ttabi at nvidia.com>

This does fix a real bug.

However, I think the real problem is that it's really confusing that
r535_gsp_msgq_recv_one_elem(gsp, &info) returns info.gsp_rpc_buf instead of
just success/failure.
r535_gsp_msgq_recv() does this:

	buf = kvmalloc(max_t(u32, rpc->length, expected), GFP_KERNEL);
...
	info.gsp_rpc_buf = buf;
... 
	buf = r535_gsp_msgq_recv_one_elem(gsp, &info);

You wouldn't know it, but this does not change the value of 'buf'
unless
r535_gsp_msgq_recv_one_elem() fails.  If it does fail, the code does this:

	if (IS_ERR(buf)) {
		kvfree(info.gsp_rpc_buf);

It would be a lot clearer if we could kvfree(buf) here, but we can't because
'buf' no longer points
to the buffer, even though the buffer still exists.

On Mon, 11 Aug 2025 17:19:00 +0800
Qianfeng Rong <rongqianfeng at vivo.com> wrote:

Acked-by: Zhi Wang <zhiw at nvidia.com>

Please add a Fixes: tag.
> Replace kfree() with kvfree() for memory allocated by kvmalloc().
> 
> Compile-tested only.
> 
> Signed-off-by: Qianfeng Rong <rongqianfeng at vivo.com>
> ---
>  drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c
b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c
> index 9d06ff722fea..0dc4782df8c0 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c
> @@ -325,7 +325,7 @@ r535_gsp_msgq_recv(struct nvkm_gsp *gsp, u32
gsp_rpc_len, int *retries)
>  
>  		rpc = r535_gsp_msgq_peek(gsp, sizeof(*rpc), info.retries);
>  		if (IS_ERR_OR_NULL(rpc)) {
> -			kfree(buf);
> +			kvfree(buf);
>  			return rpc;
>  		}
>  
> @@ -334,7 +334,7 @@ r535_gsp_msgq_recv(struct nvkm_gsp *gsp, u32
gsp_rpc_len, int *retries)
>  
>  		rpc = r535_gsp_msgq_recv_one_elem(gsp, &info);
>  		if (IS_ERR_OR_NULL(rpc)) {
> -			kfree(buf);
> +			kvfree(buf);
>  			return rpc;
>  		}
>

> Replace kfree() with kvfree() for memory allocated by kvmalloc().
* Would you like to improve the exception handling by using another goto chain?

* How do you think about to increase the application of scope-based resource
management?
  https://elixir.bootlin.com/linux/v6.16/source/include/linux/slab.h#L1081


Regards,
Markus

> Replace ?
Is there a need to adjust also the following statement combination?
https://elixir.bootlin.com/linux/v6.16/source/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c#L312-L314

?
		kvfree(info.gsp_rpc_buf);
		info.gsp_rpc_buf = NULL;
		return buf;
?

Regards,
Markus