Re: [PATCH] drm/ras: Fix memory leak in doit_reply_value() error path

["Bai, Zongyao" <zongyao.bai@intel.com>]

LGTM

Reviewed-by: Zongyao Bai <zongyao.bai@intel.com>

On 3/7/2026 10:45 AM, Shuicheng Lin wrote:
> If get_node_error_counter() fails after genlmsg_iput() has succeeded,
> the allocated msg sk_buff is leaked. Refactor the error paths to use
> goto labels, fixing the leak and eliminating duplicate cleanup code.
>
> Fixes: c36218dc49f5 ("drm/ras: Introduce the DRM RAS infrastructure over generic netlink")
> Cc: Riana Tauro <riana.tauro@intel.com>
> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
> ---
>   drivers/gpu/drm/drm_ras.c | 19 +++++++++++--------
>   1 file changed, 11 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_ras.c b/drivers/gpu/drm/drm_ras.c
> index b2fa5ab86d87..e98a9e74cfd3 100644
> --- a/drivers/gpu/drm/drm_ras.c
> +++ b/drivers/gpu/drm/drm_ras.c
> @@ -195,25 +195,28 @@ static int doit_reply_value(struct genl_info *info, u32 node_id,
>   
>   	hdr = genlmsg_iput(msg, info);
>   	if (!hdr) {
> -		nlmsg_free(msg);
> -		return -EMSGSIZE;
> +		ret = -EMSGSIZE;
> +		goto err_free_msg;
>   	}
>   
>   	ret = get_node_error_counter(node_id, error_id,
>   				     &error_name, &value);
>   	if (ret)
> -		return ret;
> +		goto err_cancel_msg;
>   
>   	ret = msg_reply_value(msg, error_id, error_name, value);
> -	if (ret) {
> -		genlmsg_cancel(msg, hdr);
> -		nlmsg_free(msg);
> -		return ret;
> -	}
> +	if (ret)
> +		goto err_cancel_msg;
>   
>   	genlmsg_end(msg, hdr);
>   
>   	return genlmsg_reply(msg, info);
> +
> +err_cancel_msg:
> +	genlmsg_cancel(msg, hdr);
> +err_free_msg:
> +	nlmsg_free(msg);
> +	return ret;
>   }
>   
>   /**