AMD General

The series is Reviewed-by: Stanley.Yang <[email protected]>

Regards,
Stanley
> -----Original Message-----
> From: Liu, Xiang(Dean) <[email protected]>
> Sent: Monday, May 18, 2026 2:51 PM
> To: [email protected]
> Cc: Zhang, Hawking <[email protected]>; Zhou1, Tao
> <[email protected]>; Yang, Stanley <[email protected]>; Chai,
> Thomas <[email protected]>; Liu, Xiang(Dean) <[email protected]>
> Subject: [PATCH 3/3] drm/amd/ras: Fix UMC error address allocation leak
>
> amdgpu_umc_handle_bad_pages() allocates err_data->err_addr before
> querying UMC error information. In the direct and firmware query paths, the
> pointer is reassigned to a fresh allocation before the original buffer is 
> released,
> so the initial allocation is leaked on each handled event.
>
> Free the existing buffer before replacing it in those query paths so the 
> function
> exit cleanup only owns the active allocation.
>
> Signed-off-by: Xiang Liu <[email protected]>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
> index 1be722ba6c9e..a250109edb63 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
> @@ -130,6 +130,7 @@ void amdgpu_umc_handle_bad_pages(struct
> amdgpu_device *adev,
>                       if (adev->umc.ras && adev->umc.ras-
> >ras_block.hw_ops &&
>                           adev->umc.ras->ras_block.hw_ops-
> >query_ras_error_address &&
>                           adev->umc.max_ras_err_cnt_per_query) {
> +                             kfree(err_data->err_addr);
>                               err_data->err_addr =
>                                       kcalloc(adev-
> >umc.max_ras_err_cnt_per_query,
>                                               sizeof(struct
> eeprom_table_record), GFP_KERNEL); @@ -160,6 +161,7 @@ void
> amdgpu_umc_handle_bad_pages(struct amdgpu_device *adev,
>                       if (adev->umc.ras &&
>                           adev->umc.ras->ecc_info_query_ras_error_address
> &&
>                           adev->umc.max_ras_err_cnt_per_query) {
> +                             kfree(err_data->err_addr);
>                               err_data->err_addr =
>                                       kcalloc(adev-
> >umc.max_ras_err_cnt_per_query,
>                                               sizeof(struct
> eeprom_table_record), GFP_KERNEL);
> --
> 2.54.0

Reply via email to