[PATCH] nouveau/gsp: fix memory leak in r535_gsp_acpi_dod() unwind paths

[Danilo Krummrich]

acpi_evaluate_object() allocates the output buffer when called with
ACPI_ALLOCATE_BUFFER.

Subsequent unwind path do not free the ACPI object however, hence fix
it.

Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM")
Fixes: a9b9b42b54b2 ("nouveau/gsp: free acpi object after use")
Cc: sta...@vger.kernel.org
Signed-off-by: Danilo Krummrich <d...@kernel.org>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c 
b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c
index a575a8dbf727..214ce78b0645 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c
@@ -863,17 +863,18 @@ r535_gsp_acpi_dod(acpi_handle handle, DOD_METHOD_DATA 
*dod)
 
        if (_DOD->type != ACPI_TYPE_PACKAGE ||
            _DOD->package.count > ARRAY_SIZE(dod->acpiIdList))
-               return;
+               goto out_free;
 
        for (int i = 0; i < _DOD->package.count; i++) {
                if (WARN_ON(_DOD->package.elements[i].type != 
ACPI_TYPE_INTEGER))
-                       return;
+                       goto out_free;
 
                dod->acpiIdList[i] = _DOD->package.elements[i].integer.value;
                dod->acpiIdListLen += sizeof(dod->acpiIdList[0]);
        }
 
        dod->status = 0;
+out_free:
        kfree(output.pointer);
 }
 #endif

base-commit: 9478c166c46934160135e197b049b5a05753f2ad
-- 
2.53.0