[PATCH 1/2] drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()

[Alex Deucher]

On Tue, Nov 22, 2022 at 9:59 AM Lazar, Lijo <lijo.lazar at amd.com> wrote:
>
>
>
> On 11/22/2022 8:19 PM, Alex Deucher wrote:
> > On Tue, Nov 22, 2022 at 6:12 AM Xiongfeng Wang
> > <wangxiongfeng2 at huawei.com> wrote:
> >>
> >> As comment of pci_get_class() says, it returns a pci_device with its
> >> refcount increased and decreased the refcount for the input parameter
> >> @from if it is not NULL.
> >>
> >> If we break the loop in radeon_atrm_get_bios() with 'pdev' not NULL, we
> >> need to call pci_dev_put() to decrease the refcount. Add the missing
> >> pci_dev_put() to avoid refcount leak.
> >
> > For both patches, I think pci_dev_put() needs to go into the loops.
> > There are 2 or more GPUs on the systems where this is relevant.
> >
>
> As per the logic, the loop breaks when it finds a valid ATRM handle. So
> dev_put is required only for that device.

Sure, but what if the handle is on the second DISPLAY_VGA or
DISPLAY_OTHER class PCI device on the system?  We've already called
pci_get_class() for the first PCI device that matched.

Alex

>
> When inside the loop this happens -  "decreased the refcount for the
> input parameter @from if it is not NULL"
>
> Thanks,
> Lijo
>
> > Alex
> >
> >>
> >> Fixes: d8ade3526b2a ("drm/radeon: handle non-VGA class pci devices with ATRM")
> >> Fixes: c61e2775873f ("drm/radeon: split ATRM support out from the ATPX handler (v3)")
> >> Signed-off-by: Xiongfeng Wang <wangxiongfeng2 at huawei.com>
> >> ---
> >>   drivers/gpu/drm/radeon/radeon_bios.c | 1 +
> >>   1 file changed, 1 insertion(+)
> >>
> >> diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
> >> index 33121655d50b..2df6ce3e32cb 100644
> >> --- a/drivers/gpu/drm/radeon/radeon_bios.c
> >> +++ b/drivers/gpu/drm/radeon/radeon_bios.c
> >> @@ -227,6 +227,7 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev)
> >>
> >>          if (!found)
> >>                  return false;
> >> +       pci_dev_put(pdev);
> >>
> >>          rdev->bios = kmalloc(size, GFP_KERNEL);
> >>          if (!rdev->bios) {
> >> --
> >> 2.20.1
> >>