Mirrors/criu
1
0
Fork 0
mirror of https://github.com/checkpoint-restore/criu.git synced 2026-07-17 16:47:50 +00:00
Code Issues Projects Releases Wiki Activity

plugin/amdgpu: fix resource leaks in drm dump error paths

Browse source 
Several error paths in amdgpu_plugin_drm_dump_file() leak
resources. The drmPrimeHandleToFD() and open_img_file() failures
use break instead of goto exit, which skips per-iteration cleanup
and lets the function continue dumping metadata with a stale ret
value. Replace break with proper resource cleanup and goto exit.

The vm_info_entries buffer is not freed when the ioctl or
allocate_vm_entries() calls fail after allocating it, and the
buffer from posix_memalign() is never freed after sdma_copy_bo(),
leaking memory on every loop iteration. Add the missing xfree()
calls.

Check the amdgpu_device_initialize() return value because h_dev
is undefined on failure. Move list_handles_entries cleanup into
the exit block because error paths that goto exit skip the
existing xfree() call after the loop. Add a NULL check before
free_e(rd) because rd allocation can fail before the struct is
initialized.

Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
This commit is contained in:
Radostin Stoyanov 2026-03-14 15:55:14 +00:00
parent b518e768ce
commit 315fbed8f6
1 changed files with 23 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

29
plugins/amdgpu/amdgpu_plugin_drm.c
View file

@ -251,7 +251,7 @@ int amdgpu_plugin_drm_dump_file(int fd, int id, struct stat *drm)
size_t image_size;
struct tp_node *tp_node;
struct drm_amdgpu_gem_list_handles list_handles_args = { 0 };
struct drm_amdgpu_gem_list_handles_entry *list_handles_entries;
struct drm_amdgpu_gem_list_handles_entry *list_handles_entries = NULL;
int num_bos;
rd = xmalloc(sizeof(*rd));
@ -353,6 +353,7 @@ int amdgpu_plugin_drm_dump_file(int fd, int id, struct stat *drm)
ret = drmIoctl(fd, DRM_IOCTL_AMDGPU_GEM_OP, &vm_info_args);
if (ret) {
pr_perror("Failed to call vm info ioctl");
xfree(vm_info_entries);
goto exit;
}
@ -371,6 +372,7 @@ int amdgpu_plugin_drm_dump_file(int fd, int id, struct stat *drm)
ret = drmIoctl(fd, DRM_IOCTL_AMDGPU_GEM_OP, &vm_info_args);
if (ret) {
pr_perror("Failed to call vm info ioctl");
xfree(vm_info_entries);
goto exit;
}
} else {
@ -379,8 +381,10 @@ int amdgpu_plugin_drm_dump_file(int fd, int id, struct stat *drm)
boinfo->num_of_vms = num_vm_entries;
ret = allocate_vm_entries(boinfo, num_vm_entries);
if (ret)
if (ret) {
xfree(vm_info_entries);
goto exit;
}
for (int j = 0; j < num_vm_entries; j++) {
DrmVmEntry *vminfo = boinfo->vm_entries[j];
@ -393,20 +397,30 @@ int amdgpu_plugin_drm_dump_file(int fd, int id, struct stat *drm)
}
ret = amdgpu_device_initialize(fd, &major, &minor, &h_dev);
if (ret) {
pr_perror("Failed to initialize amdgpu device");
xfree(vm_info_entries);
goto exit;
}
device_fd = amdgpu_device_get_fd(h_dev);
ret = drmPrimeHandleToFD(device_fd, boinfo->handle, 0, &dmabuf_fd);
if (ret) {
pr_perror("Failed to get dmabuf fd from handle");
break;
amdgpu_device_deinitialize(h_dev);
xfree(vm_info_entries);
goto exit;
}
snprintf(img_path, sizeof(img_path), IMG_DRM_PAGES_FILE, rd->id, rd->drm_render_minor, i);
bo_contents_fp = open_img_file(img_path, true, &image_size, true);
if (!bo_contents_fp) {
ret = -errno;
break;
close(dmabuf_fd);
amdgpu_device_deinitialize(h_dev);
xfree(vm_info_entries);
goto exit;
}
ret = posix_memalign(&buffer, sysconf(_SC_PAGE_SIZE), handle_entry.size);
@ -424,6 +438,8 @@ int amdgpu_plugin_drm_dump_file(int fd, int id, struct stat *drm)
ret = sdma_copy_bo(dmabuf_fd, handle_entry.size, bo_contents_fp, buffer, handle_entry.size, h_dev, 0x1000,
SDMA_OP_VRAM_READ, false);
xfree(buffer);
if (dmabuf_fd != KFD_INVALID_FD)
close(dmabuf_fd);
@ -436,7 +452,6 @@ int amdgpu_plugin_drm_dump_file(int fd, int id, struct stat *drm)
xfree(vm_info_entries);
}
xfree(list_handles_entries);
for (int i = 0; i < num_bos; i++) {
DrmBoEntry *boinfo = rd->bo_entries[i];
@ -471,7 +486,9 @@ int amdgpu_plugin_drm_dump_file(int fd, int id, struct stat *drm)
xfree(buf);
exit:
free_e(rd);
xfree(list_handles_entries);
if (rd)
free_e(rd);
return ret;
}