Re: [PATCH] drm/xe/configfs: free aux. array after storing the wa_bb

["Michał Grzelak" <michal.grzelak@intel.com>]

[-- Attachment #1: Type: text/plain, Size: 1969 bytes --]

On Mon, 1 Dec 2025, Rodrigo Vivi wrote:
> On Sat, Nov 29, 2025 at 11:25:41PM +0100, Michał Grzelak wrote:
>> When commands issued via configfs are executed mid- or post GPU context
>> restoration, a temporary buffer is reallocated in order to store all of
>> commands of varying count. However, after content of the buffer has been
>> copied to the desired location it is never freed, which causes following
>> memory leak to appear when running igt@xe_configfs@ctx-restore-mid-bb:
>>
>>     kmemleak_alloc+0x4a/0x90
>>     __kmalloc_node_track_caller_noprof+0x645/0x9d0
>>     krealloc_node_align_noprof+0x206/0x3c0
>>     wa_bb_store+0xf4/0x2c0 [xe]
>>     ctx_restore_mid_bb_store+0x21/0x30 [xe]
>>     configfs_write_iter+0xe6/0x150
>>     vfs_write+0x231/0x540
>>     ksys_write+0x6d/0xf0
>>     __x64_sys_write+0x19/0x30
>>     x64_sys_call+0x79/0x2350
>>     do_syscall_64+0x93/0x10f0
>>     entry_SYSCALL_64_after_hwframe+0x76/0x7e
>>
>> Deallocate temporary array upon finishing the store of batch buffer
>> into wa_bb.
>>
>> Fixes: 39ac06f7006f ("drm/xe/configfs: Add post context restore bb")
>
> this hash is wrong:
>
> Fixes: 39ac06f70062 ("drm/xe/configfs: Add post context restore bb")
>
>> Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
>> ---
>>  drivers/gpu/drm/xe/xe_configfs.c | 2 ++
>>  1 file changed, 2 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/xe/xe_configfs.c b/drivers/gpu/drm/xe/xe_configfs.c
>> index 9f6251b1008b..f9a64352138b 100644
>> --- a/drivers/gpu/drm/xe/xe_configfs.c
>> +++ b/drivers/gpu/drm/xe/xe_configfs.c
>> @@ -789,6 +789,8 @@ static ssize_t wa_bb_store(struct wa_bb wa_bb[static XE_ENGINE_CLASS_MAX],
>>
>>  	memcpy(wa_bb, tmp_wa_bb, sizeof(tmp_wa_bb));
>>
>> +	kfree(tmp);
>
> hmm...
>
> do we need to change the kfree added in the xe_config_device_release()?

You're right, we don't need that. Sorry for the noise from this false
positive.

BR,
Michał

>
>> +
>>  	return len;
>>  }
>>
>> --
>> 2.45.2
>>
>