[PATCH] clk: mvebu: ap-cpu-clk: fix refcount leak

[PATCH] clk: mvebu: ap-cpu-clk: fix refcount leak

[Alexander A. Klimov]

Every value returned from of_clk_get() is supposed to be cleaned up
via clk_put() once not needed anymore.

Fixes: f756e362d938 ("clk: mvebu: add CPU clock driver for Armada 7K/8K")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 drivers/clk/mvebu/ap-cpu-clk.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/mvebu/ap-cpu-clk.c b/drivers/clk/mvebu/ap-cpu-clk.c
index 1e44ace7d951..7721d5fe50bc 100644
--- a/drivers/clk/mvebu/ap-cpu-clk.c
+++ b/drivers/clk/mvebu/ap-cpu-clk.c
@@ -312,6 +312,7 @@ static int ap_cpu_clock_probe(struct platform_device *pdev)
 		}
 		parent_name =  __clk_get_name(parent);
 		clk_name[12] += cluster_index;
+		clk_put(parent);
 		ap_cpu_clk[cluster_index].clk_name =
 			ap_cp_unique_name(dev, np->parent, clk_name);
 		ap_cpu_clk[cluster_index].cluster = cluster_index;
-- 
2.54.0

[PATCH] clocksource/drivers/clps711x: fix refcount leak

[Alexander A. Klimov]

Every value returned from of_clk_get() is supposed to be cleaned up
via clk_put() once not needed anymore.

Fixes: f0b7fabec327 ("clocksource: clps711x: Add CLPS711X clocksource driver")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 drivers/clocksource/clps711x-timer.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/clocksource/clps711x-timer.c b/drivers/clocksource/clps711x-timer.c
index bb0a44adaf28..d9298a5f6005 100644
--- a/drivers/clocksource/clps711x-timer.c
+++ b/drivers/clocksource/clps711x-timer.c
@@ -76,7 +76,7 @@ static int __init _clps711x_clkevt_init(struct clk *clock, void __iomem *base,
 static int __init clps711x_timer_init(struct device_node *np)
 {
 	unsigned int irq = irq_of_parse_and_map(np, 0);
-	struct clk *clock = of_clk_get(np, 0);
+	struct clk *clock;
 	void __iomem *base = of_iomap(np, 0);
 	int ret = 0;
 
@@ -86,6 +86,8 @@ static int __init clps711x_timer_init(struct device_node *np)
 		ret = -EINVAL;
 		goto unmap_io;
 	}
+
+	clock = of_clk_get(np, 0);
 	if (IS_ERR(clock)) {
 		ret = PTR_ERR(clock);
 		goto unmap_io;
@@ -103,6 +105,7 @@ static int __init clps711x_timer_init(struct device_node *np)
 		break;
 	}
 
+	clk_put(clock);
 unmap_io:
 	iounmap(base);
 	return ret;
-- 
2.54.0

[PATCH] clocksource/timer-econet-en751221: fix refcount leak

[Alexander A. Klimov]

Every value returned from of_clk_get() is supposed to be cleaned up
via clk_put() once not needed anymore.

Fixes: 3b4c33ac87d0 ("clocksource/drivers: Add EcoNet Timer HPT driver")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 drivers/clocksource/timer-econet-en751221.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clocksource/timer-econet-en751221.c b/drivers/clocksource/timer-econet-en751221.c
index 4008076b1a21..1859335345b5 100644
--- a/drivers/clocksource/timer-econet-en751221.c
+++ b/drivers/clocksource/timer-econet-en751221.c
@@ -181,6 +181,7 @@ static int __init timer_init(struct device_node *np)
 	}
 
 	econet_timer.freq_hz = clk_get_rate(clk);
+	clk_put(clk);
 
 	for (int i = 0; i < num_blocks; i++) {
 		econet_timer.membase[i] = of_iomap(np, i);
-- 
2.54.0

[PATCH] microblaze: CCF: fix refcount leak

[Alexander A. Klimov]

Every value returned from of_clk_get() is supposed to be cleaned up
via clk_put() once not needed anymore.

Fixes: c1120542b99a ("microblaze: Add support for CCF")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 arch/microblaze/kernel/cpu/cpuinfo.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/microblaze/kernel/cpu/cpuinfo.c b/arch/microblaze/kernel/cpu/cpuinfo.c
index cd9b4450763b..32c508e85408 100644
--- a/arch/microblaze/kernel/cpu/cpuinfo.c
+++ b/arch/microblaze/kernel/cpu/cpuinfo.c
@@ -133,6 +133,7 @@ void __init setup_cpuinfo_clk(void)
 		cpuinfo.cpu_clock_freq = fcpu(cpu, "timebase-frequency");
 	} else {
 		cpuinfo.cpu_clock_freq = clk_get_rate(clk);
+		clk_put(clk);
 	}
 
 	if (!cpuinfo.cpu_clock_freq) {
-- 
2.54.0

[PATCH] drm/vc4: fix krealloc() memory leak

[Alexander A. Klimov]

Don't just overwrite the original pointer passed to krealloc()
with its return value without checking latter:

    MEM = krealloc(MEM, SZ, GFP);

If krealloc() returns NULL, that erases the pointer
to the still allocated memory, hence leaks this memory.
Instead, use a temporary variable, check it's not NULL
and only then assign it to the original pointer:

    TMP = krealloc(MEM, SZ, GFP);
    if (!TMP) return;
    MEM = TMP;

Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 drivers/gpu/drm/vc4/vc4_validate_shaders.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
index d48cf76983c0..af48758592f9 100644
--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
@@ -291,14 +291,14 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
 	uint32_t o = validated_shader->num_uniform_addr_offsets;
 	uint32_t num_uniforms = validated_shader->uniforms_size / 4;
 
-	validated_shader->uniform_addr_offsets =
-		krealloc(validated_shader->uniform_addr_offsets,
-			 (o + 1) *
-			 sizeof(*validated_shader->uniform_addr_offsets),
-			 GFP_KERNEL);
-	if (!validated_shader->uniform_addr_offsets)
+	void *mem = krealloc(validated_shader->uniform_addr_offsets,
+			     (o + 1) *
+			     sizeof(*validated_shader->uniform_addr_offsets),
+			     GFP_KERNEL);
+	if (!mem)
 		return false;
 
+	validated_shader->uniform_addr_offsets = mem;
 	validated_shader->uniform_addr_offsets[o] = num_uniforms;
 	validated_shader->num_uniform_addr_offsets++;
 
-- 
2.54.0

[PATCH] ibmvnic: fix krealloc() memory leak

[Alexander A. Klimov]

Don't just overwrite the original pointer passed to krealloc()
with its return value without checking latter:

    MEM = krealloc(MEM, SZ, GFP);

If krealloc() returns NULL, that erases the pointer
to the still allocated memory, hence leaks this memory.
Instead, use a temporary variable, check it's not NULL
and only then assign it to the original pointer:

    TMP = krealloc(MEM, SZ, GFP);
    if (!TMP) return;
    MEM = TMP;

Fixes: 4e6759be28e4 ("ibmvnic: Feature implementation of Vital Product Data (VPD) for the ibmvnic driver")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 drivers/net/ethernet/ibm/ibmvnic.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 5a510eed335e..25d1d844ad19 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1761,8 +1761,9 @@ static int ibmvnic_get_vpd(struct ibmvnic_adapter *adapter)
 	union ibmvnic_crq crq;
 	int len = 0;
 	int rc;
+	unsigned char *buff = adapter->vpd->buff;
 
-	if (adapter->vpd->buff)
+	if (buff)
 		len = adapter->vpd->len;
 
 	mutex_lock(&adapter->fw_lock);
@@ -1788,17 +1789,17 @@ static int ibmvnic_get_vpd(struct ibmvnic_adapter *adapter)
 	if (!adapter->vpd->len)
 		return -ENODATA;
 
-	if (!adapter->vpd->buff)
-		adapter->vpd->buff = kzalloc(adapter->vpd->len, GFP_KERNEL);
+	if (!buff)
+		buff = kzalloc(adapter->vpd->len, GFP_KERNEL);
 	else if (adapter->vpd->len != len)
-		adapter->vpd->buff =
-			krealloc(adapter->vpd->buff,
-				 adapter->vpd->len, GFP_KERNEL);
+		buff = krealloc(buff,
+				adapter->vpd->len, GFP_KERNEL);
 
-	if (!adapter->vpd->buff) {
+	if (!buff) {
 		dev_err(dev, "Could allocate VPD buffer\n");
 		return -ENOMEM;
 	}
+	adapter->vpd->buff = buff;
 
 	adapter->vpd->dma_addr =
 		dma_map_single(dev, adapter->vpd->buff, adapter->vpd->len,
-- 
2.54.0

Re: [PATCH] ibmvnic: fix krealloc() memory leak

[Nicolai Buchwitz]

Hi Alex

You patch is missing the prefix with the target tree. Please have
a look at [1] for more details on the workflow.

On 26.5.2026 20:41, Alexander A. Klimov wrote:
> Don't just overwrite the original pointer passed to krealloc()
> with its return value without checking latter:
> 
>     MEM = krealloc(MEM, SZ, GFP);
> 
> If krealloc() returns NULL, that erases the pointer
> to the still allocated memory, hence leaks this memory.
> Instead, use a temporary variable, check it's not NULL
> and only then assign it to the original pointer:
> 
>     TMP = krealloc(MEM, SZ, GFP);
>     if (!TMP) return;
>     MEM = TMP;
> 
> Fixes: 4e6759be28e4 ("ibmvnic: Feature implementation of Vital Product 
> Data (VPD) for the ibmvnic driver")
> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
> ---
>  drivers/net/ethernet/ibm/ibmvnic.c | 15 ++++++++-------
>  1 file changed, 8 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/net/ethernet/ibm/ibmvnic.c 
> b/drivers/net/ethernet/ibm/ibmvnic.c
> index 5a510eed335e..25d1d844ad19 100644
> --- a/drivers/net/ethernet/ibm/ibmvnic.c
> +++ b/drivers/net/ethernet/ibm/ibmvnic.c
> @@ -1761,8 +1761,9 @@ static int ibmvnic_get_vpd(struct ibmvnic_adapter 
> *adapter)
>  	union ibmvnic_crq crq;
>  	int len = 0;
>  	int rc;
> +	unsigned char *buff = adapter->vpd->buff;

Should be reverse x-mas tree (longest to shortest).

> 
> -	if (adapter->vpd->buff)
> +	if (buff)
>  		len = adapter->vpd->len;
> 
>  	mutex_lock(&adapter->fw_lock);
> @@ -1788,17 +1789,17 @@ static int ibmvnic_get_vpd(struct 
> ibmvnic_adapter *adapter)
>  	if (!adapter->vpd->len)
>  		return -ENODATA;
> 
> -	if (!adapter->vpd->buff)
> -		adapter->vpd->buff = kzalloc(adapter->vpd->len, GFP_KERNEL);
> +	if (!buff)
> +		buff = kzalloc(adapter->vpd->len, GFP_KERNEL);
>  	else if (adapter->vpd->len != len)
> -		adapter->vpd->buff =
> -			krealloc(adapter->vpd->buff,
> -				 adapter->vpd->len, GFP_KERNEL);
> +		buff = krealloc(buff,
> +				adapter->vpd->len, GFP_KERNEL);

Dead branch? The only caller, init_resources(), kzalloc()s a fresh vpd
right before, and resets run release_vpd_data() first, so vpd->buff is
always NULL here and kzalloc() above always wins. The leak can't 
trigger,
which makes the Fixes tag misleading.

> 
> -	if (!adapter->vpd->buff) {
> +	if (!buff) {
>  		dev_err(dev, "Could allocate VPD buffer\n");
>  		return -ENOMEM;
>  	}
> +	adapter->vpd->buff = buff;

If you keep it anyway: on failure the old buffer stays in vpd->buff 
while
vpd->len is already the new size, a mismatch the original avoided by
NULLing. kfree() it (krealloc() does not free on failure) and NULL 
before
-ENOMEM.

> 
>  	adapter->vpd->dma_addr =
>  		dma_map_single(dev, adapter->vpd->buff, adapter->vpd->len,

[1] https://docs.kernel.org/process/maintainer-netdev.html

Thanks,
Nicolai

Re: [PATCH] clk: mvebu: ap-cpu-clk: fix refcount leak

[Brian Masney]

On Tue, May 26, 2026 at 08:40:56PM +0200, Alexander A. Klimov wrote:
> Every value returned from of_clk_get() is supposed to be cleaned up
> via clk_put() once not needed anymore.
> 
> Fixes: f756e362d938 ("clk: mvebu: add CPU clock driver for Armada 7K/8K")
> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>

Reviewed-by: Brian Masney <bmasney@redhat.com>

Re: [PATCH] ibmvnic: fix krealloc() memory leak

[Alexander A. Klimov]

On 5/26/26 22:50, Nicolai Buchwitz wrote:
> Hi Alex
> 
> You patch is missing the prefix with the target tree. Please have
> a look at [1] for more details on the workflow.

Damn. :-)

So far I've always got away with whatever I copied from the majority of
git log --oneline --follow FILE

> 
> On 26.5.2026 20:41, Alexander A. Klimov wrote:
>> Don't just overwrite the original pointer passed to krealloc()
>> with its return value without checking latter:
>>
>>     MEM = krealloc(MEM, SZ, GFP);
>>
>> If krealloc() returns NULL, that erases the pointer
>> to the still allocated memory, hence leaks this memory.
>> Instead, use a temporary variable, check it's not NULL
>> and only then assign it to the original pointer:
>>
>>     TMP = krealloc(MEM, SZ, GFP);
>>     if (!TMP) return;
>>     MEM = TMP;
>>
>> Fixes: 4e6759be28e4 ("ibmvnic: Feature implementation of Vital Product Data (VPD) for the ibmvnic driver")
>> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
>> ---
>>  drivers/net/ethernet/ibm/ibmvnic.c | 15 ++++++++-------
>>  1 file changed, 8 insertions(+), 7 deletions(-)
>>
>> diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
>> index 5a510eed335e..25d1d844ad19 100644
>> --- a/drivers/net/ethernet/ibm/ibmvnic.c
>> +++ b/drivers/net/ethernet/ibm/ibmvnic.c
>> @@ -1761,8 +1761,9 @@ static int ibmvnic_get_vpd(struct ibmvnic_adapter *adapter)
>>      union ibmvnic_crq crq;
>>      int len = 0;
>>      int rc;
>> +    unsigned char *buff = adapter->vpd->buff;
> 
> Should be reverse x-mas tree (longest to shortest).
> 
>>
>> -    if (adapter->vpd->buff)
>> +    if (buff)
>>          len = adapter->vpd->len;
>>
>>      mutex_lock(&adapter->fw_lock);
>> @@ -1788,17 +1789,17 @@ static int ibmvnic_get_vpd(struct ibmvnic_adapter *adapter)
>>      if (!adapter->vpd->len)
>>          return -ENODATA;
>>
>> -    if (!adapter->vpd->buff)
>> -        adapter->vpd->buff = kzalloc(adapter->vpd->len, GFP_KERNEL);
>> +    if (!buff)
>> +        buff = kzalloc(adapter->vpd->len, GFP_KERNEL);
>>      else if (adapter->vpd->len != len)
>> -        adapter->vpd->buff =
>> -            krealloc(adapter->vpd->buff,
>> -                 adapter->vpd->len, GFP_KERNEL);
>> +        buff = krealloc(buff,
>> +                adapter->vpd->len, GFP_KERNEL);
> 
> Dead branch? The only caller, init_resources(), kzalloc()s a fresh vpd
> right before, and resets run release_vpd_data() first, so vpd->buff is
> always NULL here and kzalloc() above always wins. The leak can't trigger,

Cool! No leak = no problem = nothing to do here

Re: [PATCH] clocksource/timer-econet-en751221: fix refcount leak

[Caleb James DeLisle]

On 26/05/2026 20:40, Alexander A. Klimov wrote:
> Every value returned from of_clk_get() is supposed to be cleaned up
> via clk_put() once not needed anymore.

Thank you for this. Since I have an open patchset on this driver, I've 
integrated your patch in v6.

Link: 
https://lore.kernel.org/linux-mips/20260528140046.2897674-1-cjd@cjdns.fr/

Thanks,

Caleb

>
> Fixes: 3b4c33ac87d0 ("clocksource/drivers: Add EcoNet Timer HPT driver")
> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
> ---
>   drivers/clocksource/timer-econet-en751221.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/drivers/clocksource/timer-econet-en751221.c b/drivers/clocksource/timer-econet-en751221.c
> index 4008076b1a21..1859335345b5 100644
> --- a/drivers/clocksource/timer-econet-en751221.c
> +++ b/drivers/clocksource/timer-econet-en751221.c
> @@ -181,6 +181,7 @@ static int __init timer_init(struct device_node *np)
>   	}
>   
>   	econet_timer.freq_hz = clk_get_rate(clk);
> +	clk_put(clk);
>   
>   	for (int i = 0; i < num_blocks; i++) {
>   		econet_timer.membase[i] = of_iomap(np, i);

Re: [PATCH] drm/vc4: fix krealloc() memory leak

[Maíra Canal]

Hi Alexander,

LGTM, but a small styling nit:

On 26/05/26 15:41, Alexander A. Klimov wrote:
> Don't just overwrite the original pointer passed to krealloc()
> with its return value without checking latter:
> 
>      MEM = krealloc(MEM, SZ, GFP);
> 
> If krealloc() returns NULL, that erases the pointer
> to the still allocated memory, hence leaks this memory.
> Instead, use a temporary variable, check it's not NULL
> and only then assign it to the original pointer:
> 
>      TMP = krealloc(MEM, SZ, GFP);
>      if (!TMP) return;
>      MEM = TMP;
> 
> Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
> ---
>   drivers/gpu/drm/vc4/vc4_validate_shaders.c | 12 ++++++------
>   1 file changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
> index d48cf76983c0..af48758592f9 100644
> --- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
> +++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
> @@ -291,14 +291,14 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
>   	uint32_t o = validated_shader->num_uniform_addr_offsets;
>   	uint32_t num_uniforms = validated_shader->uniforms_size / 4;

Declare the variable here.

>   
> -	validated_shader->uniform_addr_offsets =
> -		krealloc(validated_shader->uniform_addr_offsets,
> -			 (o + 1) *
> -			 sizeof(*validated_shader->uniform_addr_offsets),
> -			 GFP_KERNEL);
> -	if (!validated_shader->uniform_addr_offsets)
> +	void *mem = krealloc(validated_shader->uniform_addr_offsets,

Instead of void *, you should probably use uint32_t *.

Best regards,
- Maíra

> +			     (o + 1) *
> +			     sizeof(*validated_shader->uniform_addr_offsets),
> +			     GFP_KERNEL);
> +	if (!mem)
>   		return false;
>   
> +	validated_shader->uniform_addr_offsets = mem;
>   	validated_shader->uniform_addr_offsets[o] = num_uniforms;
>   	validated_shader->num_uniform_addr_offsets++;
>   

Re: [PATCH] drm/vc4: fix krealloc() memory leak

[Alexander A. Klimov]

On 5/28/26 20:17, Maíra Canal wrote:
> Hi Alexander,
> 
> LGTM, but a small styling nit:
> 
> On 26/05/26 15:41, Alexander A. Klimov wrote:
>> Don't just overwrite the original pointer passed to krealloc()
>> with its return value without checking latter:
>>
>>      MEM = krealloc(MEM, SZ, GFP);
>>
>> If krealloc() returns NULL, that erases the pointer
>> to the still allocated memory, hence leaks this memory.
>> Instead, use a temporary variable, check it's not NULL
>> and only then assign it to the original pointer:
>>
>>      TMP = krealloc(MEM, SZ, GFP);
>>      if (!TMP) return;
>>      MEM = TMP;
>>
>> Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
>> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
>> ---
>>   drivers/gpu/drm/vc4/vc4_validate_shaders.c | 12 ++++++------
>>   1 file changed, 6 insertions(+), 6 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
>> index d48cf76983c0..af48758592f9 100644
>> --- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
>> +++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
>> @@ -291,14 +291,14 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
>>       uint32_t o = validated_shader->num_uniform_addr_offsets;
>>       uint32_t num_uniforms = validated_shader->uniforms_size / 4;
> 
> Declare the variable here.

Strange...
It comes already directly after num_uniforms, doesn't it?
At least when I apply my patch to Linus' master.

Re: [PATCH] drm/vc4: fix krealloc() memory leak

[Maíra Canal]

Hi Alexander,

On 28/05/26 15:54, Alexander A. Klimov wrote:
> 
> 
> On 5/28/26 20:17, Maíra Canal wrote:
>> Hi Alexander,
>>
>> LGTM, but a small styling nit:
>>
>> On 26/05/26 15:41, Alexander A. Klimov wrote:
>>> Don't just overwrite the original pointer passed to krealloc()
>>> with its return value without checking latter:
>>>
>>>      MEM = krealloc(MEM, SZ, GFP);
>>>
>>> If krealloc() returns NULL, that erases the pointer
>>> to the still allocated memory, hence leaks this memory.
>>> Instead, use a temporary variable, check it's not NULL
>>> and only then assign it to the original pointer:
>>>
>>>      TMP = krealloc(MEM, SZ, GFP);
>>>      if (!TMP) return;
>>>      MEM = TMP;
>>>
>>> Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader 
>>> validation.")
>>> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
>>> ---
>>>   drivers/gpu/drm/vc4/vc4_validate_shaders.c | 12 ++++++------
>>>   1 file changed, 6 insertions(+), 6 deletions(-)
>>>
>>> diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/ 
>>> gpu/drm/vc4/vc4_validate_shaders.c
>>> index d48cf76983c0..af48758592f9 100644
>>> --- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
>>> +++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
>>> @@ -291,14 +291,14 @@ static bool 
>>> require_uniform_address_uniform(struct vc4_validated_shader_info *va
>>>       uint32_t o = validated_shader->num_uniform_addr_offsets;
>>>       uint32_t num_uniforms = validated_shader->uniforms_size / 4;
>>
>> Declare the variable here.
> 
> Strange...
> It comes already directly after num_uniforms, doesn't it?

Yeah, it does. However, usually, we declare the variables and then we
proceed to the functions. Check, for example, the function
record_texture_sample() in vc4.

Best regards,
- Maíra

> At least when I apply my patch to Linus' master.

[PATCH v2] drm/vc4: fix krealloc() memory leak

[Alexander A. Klimov]

Don't just overwrite the original pointer passed to krealloc()
with its return value without checking latter:

    MEM = krealloc(MEM, SZ, GFP);

If krealloc() returns NULL, that erases the pointer
to the still allocated memory, hence leaks this memory.
Instead, use a temporary variable, check it's not NULL
and only then assign it to the original pointer:

    TMP = krealloc(MEM, SZ, GFP);
    if (!TMP) return;
    MEM = TMP;

Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 v2: Declare the variable explicitly
 v2: Instead of void *, use u32 *
 v2: While on it, enhance variable name

 [✓] scripts/checkpatch.pl --strict
 [✓] allmodconfig compiled (i686, LLVM)
 [✓] localyesconfig booted (IBM T43)

 Note to myself: use --in-reply-to=2b602ec6-d563-4fa0-a0c5-89b97a46abf9@igalia.com

 drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
index d48cf76983c0..6f52b4db9cc9 100644
--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
@@ -290,15 +290,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
 {
 	uint32_t o = validated_shader->num_uniform_addr_offsets;
 	uint32_t num_uniforms = validated_shader->uniforms_size / 4;
+	u32 *offsets;
 
-	validated_shader->uniform_addr_offsets =
-		krealloc(validated_shader->uniform_addr_offsets,
-			 (o + 1) *
-			 sizeof(*validated_shader->uniform_addr_offsets),
-			 GFP_KERNEL);
-	if (!validated_shader->uniform_addr_offsets)
+	offsets = krealloc(validated_shader->uniform_addr_offsets,
+			   (o + 1) *
+			   sizeof(*validated_shader->uniform_addr_offsets),
+			   GFP_KERNEL);
+	if (!offsets)
 		return false;
 
+	validated_shader->uniform_addr_offsets = offsets;
 	validated_shader->uniform_addr_offsets[o] = num_uniforms;
 	validated_shader->num_uniform_addr_offsets++;
 
-- 
2.54.0

Re: [PATCH v2] drm/vc4: fix krealloc() memory leak

[Joe Perches]

On Sun, 2026-05-31 at 21:55 +0200, Alexander A. Klimov wrote:
> Don't just overwrite the original pointer passed to krealloc()
> with its return value without checking latter:
[]
> diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
[]
> @@ -290,15 +290,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
>  {
>  	uint32_t o = validated_shader->num_uniform_addr_offsets;
>  	uint32_t num_uniforms = validated_shader->uniforms_size / 4;
> +	u32 *offsets;
>  
> -	validated_shader->uniform_addr_offsets =
> -		krealloc(validated_shader->uniform_addr_offsets,
> -			 (o + 1) *
> -			 sizeof(*validated_shader->uniform_addr_offsets),
> -			 GFP_KERNEL);
> -	if (!validated_shader->uniform_addr_offsets)
> +	offsets = krealloc(validated_shader->uniform_addr_offsets,
> +			   (o + 1) *
> +			   sizeof(*validated_shader->uniform_addr_offsets),
> +			   GFP_KERNEL);

krealloc_array ?

> +	if (!offsets)
>  		return false;
>  
> +	validated_shader->uniform_addr_offsets = offsets;
>  	validated_shader->uniform_addr_offsets[o] = num_uniforms;
>  	validated_shader->num_uniform_addr_offsets++;

[PATCH v3] drm/vc4: fix krealloc() memory leak

[Alexander A. Klimov]

Don't just overwrite the original pointer passed to krealloc()
with its return value without checking latter:

    MEM = krealloc(MEM, SZ, GFP);

If krealloc() returns NULL, that erases the pointer
to the still allocated memory, hence leaks this memory.
Instead, use a temporary variable, check it's not NULL
and only then assign it to the original pointer:

    TMP = krealloc(MEM, SZ, GFP);
    if (!TMP) return;
    MEM = TMP;

While on it, use krealloc_array().

Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
 v2: Declare the variable explicitly
 v2: Instead of void *, use u32 *
 v2: While on it, enhance variable name
 v3: Use krealloc_array()

 [✓] scripts/checkpatch.pl --strict
 [✓] allmodconfig compiled (i686, LLVM)
 [✓] localyesconfig booted (IBM T43)

 Note to myself: use --in-reply-to=e1edeadb7c161580a5cd5c7e642dc1b28db8ee86.camel@perches.com

 drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
index d48cf76983c0..66502a6a4a8e 100644
--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
@@ -290,15 +290,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
 {
 	uint32_t o = validated_shader->num_uniform_addr_offsets;
 	uint32_t num_uniforms = validated_shader->uniforms_size / 4;
+	u32 *offsets;
 
-	validated_shader->uniform_addr_offsets =
-		krealloc(validated_shader->uniform_addr_offsets,
-			 (o + 1) *
-			 sizeof(*validated_shader->uniform_addr_offsets),
-			 GFP_KERNEL);
-	if (!validated_shader->uniform_addr_offsets)
+	offsets = krealloc_array(validated_shader->uniform_addr_offsets,
+				 o + 1,
+				 sizeof(*validated_shader->uniform_addr_offsets),
+				 GFP_KERNEL);
+	if (!offsets)
 		return false;
 
+	validated_shader->uniform_addr_offsets = offsets;
 	validated_shader->uniform_addr_offsets[o] = num_uniforms;
 	validated_shader->num_uniform_addr_offsets++;
 
-- 
2.54.0

Re: [PATCH v3] drm/vc4: fix krealloc() memory leak

[Maíra Canal]

On 06/06/26 09:38, Alexander A. Klimov wrote:
> Don't just overwrite the original pointer passed to krealloc()
> with its return value without checking latter:
> 
>      MEM = krealloc(MEM, SZ, GFP);
> 
> If krealloc() returns NULL, that erases the pointer
> to the still allocated memory, hence leaks this memory.
> Instead, use a temporary variable, check it's not NULL
> and only then assign it to the original pointer:
> 
>      TMP = krealloc(MEM, SZ, GFP);
>      if (!TMP) return;
>      MEM = TMP;
> 
> While on it, use krealloc_array().
> 
> Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>

Reviewed-by: Maíra Canal <mcanal@igalia.com>

Best regards,
- Maíra

> ---
>   v2: Declare the variable explicitly
>   v2: Instead of void *, use u32 *
>   v2: While on it, enhance variable name
>   v3: Use krealloc_array()
> 
>   [✓] scripts/checkpatch.pl --strict
>   [✓] allmodconfig compiled (i686, LLVM)
>   [✓] localyesconfig booted (IBM T43)
> 
>   Note to myself: use --in-reply-to=e1edeadb7c161580a5cd5c7e642dc1b28db8ee86.camel@perches.com
> 
>   drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------
>   1 file changed, 7 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
> index d48cf76983c0..66502a6a4a8e 100644
> --- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
> +++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
> @@ -290,15 +290,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
>   {
>   	uint32_t o = validated_shader->num_uniform_addr_offsets;
>   	uint32_t num_uniforms = validated_shader->uniforms_size / 4;
> +	u32 *offsets;
>   
> -	validated_shader->uniform_addr_offsets =
> -		krealloc(validated_shader->uniform_addr_offsets,
> -			 (o + 1) *
> -			 sizeof(*validated_shader->uniform_addr_offsets),
> -			 GFP_KERNEL);
> -	if (!validated_shader->uniform_addr_offsets)
> +	offsets = krealloc_array(validated_shader->uniform_addr_offsets,
> +				 o + 1,
> +				 sizeof(*validated_shader->uniform_addr_offsets),
> +				 GFP_KERNEL);
> +	if (!offsets)
>   		return false;
>   
> +	validated_shader->uniform_addr_offsets = offsets;
>   	validated_shader->uniform_addr_offsets[o] = num_uniforms;
>   	validated_shader->num_uniform_addr_offsets++;
>   

Re: [PATCH v3] drm/vc4: fix krealloc() memory leak

[Maíra Canal]

Hi Alexander,

On 06/06/26 09:38, Alexander A. Klimov wrote:
> Don't just overwrite the original pointer passed to krealloc()
> with its return value without checking latter:
> 
>      MEM = krealloc(MEM, SZ, GFP);
> 
> If krealloc() returns NULL, that erases the pointer
> to the still allocated memory, hence leaks this memory.
> Instead, use a temporary variable, check it's not NULL
> and only then assign it to the original pointer:
> 
>      TMP = krealloc(MEM, SZ, GFP);
>      if (!TMP) return;
>      MEM = TMP;
> 
> While on it, use krealloc_array().
> 
> Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>

Applied to drm/misc/kernel (drm-misc-fixes).

Best Regards,
- Maíra

> ---
>   v2: Declare the variable explicitly
>   v2: Instead of void *, use u32 *
>   v2: While on it, enhance variable name
>   v3: Use krealloc_array()
> 
>   [✓] scripts/checkpatch.pl --strict
>   [✓] allmodconfig compiled (i686, LLVM)
>   [✓] localyesconfig booted (IBM T43)
> 
>   Note to myself: use --in-reply-to=e1edeadb7c161580a5cd5c7e642dc1b28db8ee86.camel@perches.com
> 
>   drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------
>   1 file changed, 7 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
> index d48cf76983c0..66502a6a4a8e 100644
> --- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
> +++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
> @@ -290,15 +290,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va
>   {
>   	uint32_t o = validated_shader->num_uniform_addr_offsets;
>   	uint32_t num_uniforms = validated_shader->uniforms_size / 4;
> +	u32 *offsets;
>   
> -	validated_shader->uniform_addr_offsets =
> -		krealloc(validated_shader->uniform_addr_offsets,
> -			 (o + 1) *
> -			 sizeof(*validated_shader->uniform_addr_offsets),
> -			 GFP_KERNEL);
> -	if (!validated_shader->uniform_addr_offsets)
> +	offsets = krealloc_array(validated_shader->uniform_addr_offsets,
> +				 o + 1,
> +				 sizeof(*validated_shader->uniform_addr_offsets),
> +				 GFP_KERNEL);
> +	if (!offsets)
>   		return false;
>   
> +	validated_shader->uniform_addr_offsets = offsets;
>   	validated_shader->uniform_addr_offsets[o] = num_uniforms;
>   	validated_shader->num_uniform_addr_offsets++;
>