drm/amd/ras: Fix UMC error address allocation leak

amdgpu_umc_handle_bad_pages() allocates err_data->err_addr before
querying UMC error information. In the direct and firmware query paths,
the pointer is reassigned to a fresh allocation before the original
buffer is released, so the initial allocation is leaked on each handled
event.

Free the existing buffer before replacing it in those query paths so the
function exit cleanup only owns the active allocation.

Signed-off-by: Xiang Liu <xiang.liu@amd.com>
Reviewed-by: Stanley.Yang <Stanley.Yang@amd.com>
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 911b1bdd22c3712a22b60fcc58f7b9f2d07b0803)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
index 0238c2798de4ecf165d5604acc9312d7fbc363ad..b8ed931f8a4074dd364fc6c6f649431a25db89fe 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
@@ -130,6 +130,7 @@ void amdgpu_umc_handle_bad_pages(struct amdgpu_device *adev,
                        if (adev->umc.ras && adev->umc.ras->ras_block.hw_ops &&
                            adev->umc.ras->ras_block.hw_ops->query_ras_error_address &&
                            adev->umc.max_ras_err_cnt_per_query) {
+                               kfree(err_data->err_addr);
                                err_data->err_addr =
                                        kzalloc_objs(struct eeprom_table_record,
                                                     adev->umc.max_ras_err_cnt_per_query);
@@ -160,6 +161,7 @@ void amdgpu_umc_handle_bad_pages(struct amdgpu_device *adev,
                        if (adev->umc.ras &&
                            adev->umc.ras->ecc_info_query_ras_error_address &&
                            adev->umc.max_ras_err_cnt_per_query) {
+                               kfree(err_data->err_addr);
                                err_data->err_addr =
                                        kzalloc_objs(struct eeprom_table_record,
                                                     adev->umc.max_ras_err_cnt_per_query);