[PATCH] drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()

[PATCH] drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()

[Qianfeng Rong]

Replace kfree() with kvfree() for memory allocated by kvmalloc().

Compile-tested only.

Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c
index 9d06ff722fea..0dc4782df8c0 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c
@@ -325,7 +325,7 @@ r535_gsp_msgq_recv(struct nvkm_gsp *gsp, u32 gsp_rpc_len, int *retries)
 
 		rpc = r535_gsp_msgq_peek(gsp, sizeof(*rpc), info.retries);
 		if (IS_ERR_OR_NULL(rpc)) {
-			kfree(buf);
+			kvfree(buf);
 			return rpc;
 		}
 
@@ -334,7 +334,7 @@ r535_gsp_msgq_recv(struct nvkm_gsp *gsp, u32 gsp_rpc_len, int *retries)
 
 		rpc = r535_gsp_msgq_recv_one_elem(gsp, &info);
 		if (IS_ERR_OR_NULL(rpc)) {
-			kfree(buf);
+			kvfree(buf);
 			return rpc;
 		}
 
-- 
2.34.1

Re: [PATCH] drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()

[Timur Tabi]

On Mon, 2025-08-11 at 17:19 +0800, Qianfeng Rong wrote:
> Replace kfree() with kvfree() for memory allocated by kvmalloc().
> 
> Compile-tested only.
> 
> Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>

Reviewed-by: Timur Tabi <ttabi@nvidia.com>

This does fix a real bug.

However, I think the real problem is that it's really confusing that
r535_gsp_msgq_recv_one_elem(gsp, &info) returns info.gsp_rpc_buf instead of just success/failure. 
r535_gsp_msgq_recv() does this:

	buf = kvmalloc(max_t(u32, rpc->length, expected), GFP_KERNEL);
...
	info.gsp_rpc_buf = buf;
... 
	buf = r535_gsp_msgq_recv_one_elem(gsp, &info);

You wouldn't know it, but this does not change the value of 'buf' unless
r535_gsp_msgq_recv_one_elem() fails.  If it does fail, the code does this:

	if (IS_ERR(buf)) {
		kvfree(info.gsp_rpc_buf);

It would be a lot clearer if we could kvfree(buf) here, but we can't because 'buf' no longer points
to the buffer, even though the buffer still exists.

Re: [PATCH] drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()

[Zhi Wang]

On Mon, 11 Aug 2025 17:19:00 +0800
Qianfeng Rong <rongqianfeng@vivo.com> wrote:

Acked-by: Zhi Wang <zhiw@nvidia.com>

Please add a Fixes: tag.

> Replace kfree() with kvfree() for memory allocated by kvmalloc().
> 
> Compile-tested only.
> 
> Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
> ---
>  drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c
> index 9d06ff722fea..0dc4782df8c0 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c
> @@ -325,7 +325,7 @@ r535_gsp_msgq_recv(struct nvkm_gsp *gsp, u32 gsp_rpc_len, int *retries)
>  
>  		rpc = r535_gsp_msgq_peek(gsp, sizeof(*rpc), info.retries);
>  		if (IS_ERR_OR_NULL(rpc)) {
> -			kfree(buf);
> +			kvfree(buf);
>  			return rpc;
>  		}
>  
> @@ -334,7 +334,7 @@ r535_gsp_msgq_recv(struct nvkm_gsp *gsp, u32 gsp_rpc_len, int *retries)
>  
>  		rpc = r535_gsp_msgq_recv_one_elem(gsp, &info);
>  		if (IS_ERR_OR_NULL(rpc)) {
> -			kfree(buf);
> +			kvfree(buf);
>  			return rpc;
>  		}
>  

Re: [PATCH] drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()

[Danilo Krummrich]

On Wed Aug 13, 2025 at 12:52 AM CEST, Timur Tabi wrote:
> On Mon, 2025-08-11 at 17:19 +0800, Qianfeng Rong wrote:
>> Replace kfree() with kvfree() for memory allocated by kvmalloc().
>> 
>> Compile-tested only.
>> 
>> Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
>
> Reviewed-by: Timur Tabi <ttabi@nvidia.com>
>
> This does fix a real bug.
>
> However, I think the real problem is that it's really confusing that
> r535_gsp_msgq_recv_one_elem(gsp, &info) returns info.gsp_rpc_buf instead of just success/failure. 
> r535_gsp_msgq_recv() does this:
>
> 	buf = kvmalloc(max_t(u32, rpc->length, expected), GFP_KERNEL);
> ...
> 	info.gsp_rpc_buf = buf;
> ... 
> 	buf = r535_gsp_msgq_recv_one_elem(gsp, &info);
>
> You wouldn't know it, but this does not change the value of 'buf' unless
> r535_gsp_msgq_recv_one_elem() fails.  If it does fail, the code does this:

Ick! That makes no sense, r535_gsp_msgq_recv_one_elem() should just return an
int and we shouldn't overwrite buf -- that's a footgun.

> 	if (IS_ERR(buf)) {
> 		kvfree(info.gsp_rpc_buf);

Should just be

	if (ret) {
		kvfree(buf);
		return ERR_PTR(ret);
	}

It also doesn't need the info.gsp_rpc_buf = NULL; assignment, info is local
anyways.

> It would be a lot clearer if we could kvfree(buf) here, but we can't because 'buf' no longer points
> to the buffer, even though the buffer still exists.

Agreed.

Zhi, Timur do you want to send a follow-up patch for this?

Re: [PATCH] drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()

[Zhi Wang]

On 13/08/2025 1.52, Timur Tabi wrote:
> On Mon, 2025-08-11 at 17:19 +0800, Qianfeng Rong wrote:
>> Replace kfree() with kvfree() for memory allocated by kvmalloc().
>>
>> Compile-tested only.
>>
>> Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
> 
> Reviewed-by: Timur Tabi <ttabi@nvidia.com>
> 
> This does fix a real bug.
> 

Agree with the coding details.

I felt the core issue is that GSP RPC lifecycle management in NVKM is 
not handled cleanly. For example, the caller’s RPC buffer is freed 
silently in the receive path, and a new buffer is allocated and returned 
without explicit coordination.

Introducing large GSP RPCs - such as factoring out 
r535_gsp_msgq_recv_one_elem() - only makes this flaw more apparent, and 
even the refactoring process is cumbersome and tricky.

Ideally, there should be a clear ownership and lifecycle flow between 
the caller and the GSP RPC routines: the caller allocates and frees the 
RPC buffer, while the low-level routines focus solely on send/receive 
operations. r535_gsp_msgq_recv_one_elem() is just on its half way.

Z.

> However, I think the real problem is that it's really confusing that
> r535_gsp_msgq_recv_one_elem(gsp, &info) returns info.gsp_rpc_buf instead of just success/failure.
> r535_gsp_msgq_recv() does this:
> 
> 	buf = kvmalloc(max_t(u32, rpc->length, expected), GFP_KERNEL);
> ...
> 	info.gsp_rpc_buf = buf;
> ...
> 	buf = r535_gsp_msgq_recv_one_elem(gsp, &info);
> 
> You wouldn't know it, but this does not change the value of 'buf' unless
> r535_gsp_msgq_recv_one_elem() fails.  If it does fail, the code does this:
> 
> 	if (IS_ERR(buf)) {
> 		kvfree(info.gsp_rpc_buf);
> 
> It would be a lot clearer if we could kvfree(buf) here, but we can't because 'buf' no longer points
> to the buffer, even though the buffer still exists.
> 
> 

Re: [PATCH] drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()

[Danilo Krummrich]

On Wed Aug 13, 2025 at 12:46 PM CEST, Zhi Wang wrote:
> On Mon, 11 Aug 2025 17:19:00 +0800
> Qianfeng Rong <rongqianfeng@vivo.com> wrote:
>
> Acked-by: Zhi Wang <zhiw@nvidia.com>
>
> Please add a Fixes: tag.

And please also add "Cc: stable@vger.kernel.org", thanks!

Re: [PATCH] drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()

[Qianfeng Rong]

在 2025/8/13 19:01, Danilo Krummrich 写道:
> [You don't often get email from dakr@kernel.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> On Wed Aug 13, 2025 at 12:46 PM CEST, Zhi Wang wrote:
>> On Mon, 11 Aug 2025 17:19:00 +0800
>> Qianfeng Rong <rongqianfeng@vivo.com> wrote:
>>
>> Acked-by: Zhi Wang <zhiw@nvidia.com>
>>
>> Please add a Fixes: tag.
> And please also add "Cc: stable@vger.kernel.org", thanks!
Ok,  Will do in the next version.

Re: [PATCH] drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()

[Markus Elfring]

> Replace kfree() with kvfree() for memory allocated by kvmalloc().

* Would you like to improve the exception handling by using another goto chain?

* How do you think about to increase the application of scope-based resource management?
  https://elixir.bootlin.com/linux/v6.16/source/include/linux/slab.h#L1081


Regards,
Markus

Re: [PATCH] drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()

[Markus Elfring]

> Replace …

Is there a need to adjust also the following statement combination?
https://elixir.bootlin.com/linux/v6.16/source/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c#L312-L314

…
		kvfree(info.gsp_rpc_buf);
		info.gsp_rpc_buf = NULL;
		return buf;
…

Regards,
Markus

Re: [PATCH] drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()

[Timur Tabi]

On Wed, 2025-08-13 at 13:00 +0200, Danilo Krummrich wrote:
> > It would be a lot clearer if we could kvfree(buf) here, but we can't because 'buf' no longer
> > points
> > to the buffer, even though the buffer still exists.
> 
> Agreed.
> 
> Zhi, Timur do you want to send a follow-up patch for this?

Yes, I'll send a patch this week that sits on top of Qianfeng's patch.