From 2fb6ce14f4fbd6b57b3f0cc3c4eb6e6b0c309586 Mon Sep 17 00:00:00 2001 From: JD Daniels Date: Wed, 16 Sep 2026 06:49:52 -0500 Subject: [PATCH] nvidia-modeset: free the semaphore surface callback record when the waiter is already signalled nvKmsKapiRegisterSemaphoreSurfaceCallback() allocates a struct NvKmsKapiSemaphoreSurfaceCallback before asking RM to register a waiter. When RM answers NVOS_STATUS_ERROR_ALREADY_SIGNALLED the function returns without freeing the record and without handing it to the caller, so neither of the two documented release paths (the callback running, or unregisterSemaphoreSurfaceCallback()) can ever reach it. nvidia-drm takes this path for every semaphore surface fence whose GPU work completes before the waiter is registered, which on a Wayland compositor is nearly every composited frame. The result is a 40-byte kmalloc-64 object leaked per frame: 11.6 million objects and 2.2 GB of unreclaimable slab over 4.5 days of desktop use on 595.71.05, attributed with slub_debug=U to this call site through __nv_drm_semsurf_ctx_reg_callbacks(). Applies to every tag from 545.29.06 through 610.57.04 and to main. --- src/nvidia-modeset/kapi/src/nvkms-kapi-sync.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/nvidia-modeset/kapi/src/nvkms-kapi-sync.c b/src/nvidia-modeset/kapi/src/nvkms-kapi-sync.c index 1b243d64e6..0d81a958fb 100644 --- a/src/nvidia-modeset/kapi/src/nvkms-kapi-sync.c +++ b/src/nvidia-modeset/kapi/src/nvkms-kapi-sync.c @@ -445,6 +445,11 @@ nvKmsKapiRegisterSemaphoreSurfaceCallback( } return NVKMS_KAPI_REG_WAITER_SUCCESS; case NVOS_STATUS_ERROR_ALREADY_SIGNALLED: + /* + * No waiter was registered, so neither the callback nor + * unregisterSemaphoreSurfaceCallback() will ever free cb. + */ + nvKmsKapiFree(cb); return NVKMS_KAPI_REG_WAITER_ALREADY_SIGNALLED; default: break;