]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
authorZhu Lingshan <lingshan.zhu@amd.com>
Wed, 1 Jul 2026 10:53:21 +0000 (18:53 +0800)
committerAlex Deucher <alexander.deucher@amd.com>
Fri, 17 Jul 2026 21:38:33 +0000 (17:38 -0400)
amdgpu_bo_create_reserved() only allocates a new BO when
*bo_ptr (struct amdgpu_bo **bo_ptr as input parameter) is
NULL, it simply skips creation when *bo_ptr is non-NULL.
But it unconditionally reserves, pins, gart allocates
and maps the BO afterwards.

When the same non-NULL BO pointer is passed in again,
for example firmware buffers that live in adev and are
re-loaded on every resume / cp_resume / start
under AMDGPU_FW_LOAD_DIRECT, amdgpu_bo_pin() just increases
pin_count unconditionally, however the matching teardown only unpins
once, so pin_count never drops to zero, so TTM is not able
to move, swap or evict a BO, causing BO leaks.

This commit fixes this issue by only pinning the bo
once at creation, and repeated calls no longer
take additional pin references.

Signed-off-by: Zhu Lingshan <lingshan.zhu@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 3ddc0ae76202c447b6aec61e907b852bc94671cf)
Cc: stable@vger.kernel.org
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c

index f98bfba59a2ceeffd7803d8a6648853cad6c910d..718937777e5323723a96f33492cf7e3594914269 100644 (file)
@@ -276,10 +276,12 @@ int amdgpu_bo_create_reserved(struct amdgpu_device *adev,
                goto error_free;
        }
 
-       r = amdgpu_bo_pin(*bo_ptr, domain);
-       if (r) {
-               dev_err(adev->dev, "(%d) kernel bo pin failed\n", r);
-               goto error_unreserve;
+       if (free) {
+               r = amdgpu_bo_pin(*bo_ptr, domain);
+               if (r) {
+                       dev_err(adev->dev, "(%d) kernel bo pin failed\n", r);
+                       goto error_unreserve;
+               }
        }
 
        r = amdgpu_ttm_alloc_gart(&(*bo_ptr)->tbo);
@@ -302,7 +304,8 @@ int amdgpu_bo_create_reserved(struct amdgpu_device *adev,
        return 0;
 
 error_unpin:
-       amdgpu_bo_unpin(*bo_ptr);
+       if (free)
+               amdgpu_bo_unpin(*bo_ptr);
 error_unreserve:
        amdgpu_bo_unreserve(*bo_ptr);