From: Lizhi Hou <lizhi.hou@amd.com>
Date: Tue, 7 Jul 2026 05:56:58 +0000 (-0700)
Subject: accel/amdxdna: fix open_ref leak and stale client pointer on dma map failure
X-Git-Tag: v7.2-rc3~27^2~3^2~10
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=66ff5c0eee02c4be67f8ba7fb6c63709ef1c92a3;p=thirdparty%2Fkernel%2Flinux.git

accel/amdxdna: fix open_ref leak and stale client pointer on dma map failure

amdxdna_gem_obj_open() increments open_ref before attempting to set up
the DMA address mapping.  When amdxdna_dma_map_bo() fails, the function
returned immediately without rolling back either change made on the first
open (open_ref == 1 path).

Fix it by decrementing open_ref and clearing abo->client on the error path.

Fixes: ece3e8980907 ("accel/amdxdna: Allow forcing IOVA-based DMA via module parameter")
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260707055658.479049-1-lizhi.hou@amd.com
---

diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
index 0c10ec0cc5e4..1275f91ca705 100644
--- a/drivers/accel/amdxdna/amdxdna_gem.c
+++ b/drivers/accel/amdxdna/amdxdna_gem.c
@@ -664,8 +664,11 @@ static int amdxdna_gem_obj_open(struct drm_gem_object *gobj, struct drm_file *fi
 	/* No need to set up dma addr mapping in PASID mode. */
 	if (!amdxdna_pasid_on(abo->client)) {
 		ret = amdxdna_dma_map_bo(xdna, abo);
-		if (ret)
+		if (ret) {
+			abo->open_ref--;
+			abo->client = NULL;
 			return ret;
+		}
 	}
 
 	amdxdna_gem_add_bo_usage(abo);