]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure
authorShuicheng Lin <shuicheng.lin@intel.com>
Wed, 8 Apr 2026 17:52:54 +0000 (17:52 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 17 May 2026 15:16:31 +0000 (17:16 +0200)
commit8fa8c2a22585fcb31dc605b91a67bbcca223fdd7
treec9d2f60cf97032b3633538eb0c8eecae57a96700
parent5ed57e26e2c04277e60afa9dc9a5cb0f68365e39
drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure

commit 93a528f67ce5095bcab46a69839eca97f43dd352 upstream.

When drm_gpuvm_resv_object_alloc() fails, the pre-allocated storage bo
is not freed. Add xe_bo_free(storage) before returning the error.

xe_dma_buf_init_obj() calls xe_bo_init_locked(), which frees the bo on
error. Therefore, xe_dma_buf_init_obj() must also free the bo on its own
error paths. Otherwise, since xe_gem_prime_import() cannot distinguish
whether the failure originated from xe_dma_buf_init_obj() or from
xe_bo_init_locked(), it cannot safely decide whether the bo should be
freed.

Add comments documenting the ownership semantics: on success, ownership
of storage is transferred to the returned drm_gem_object; on failure,
storage is freed before returning.

v2: Add comments to explain the free logic.

Fixes: eb289a5f6cc6 ("drm/xe: Convert xe_dma_buf.c for exhaustive eviction")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260408175255.3402838-4-shuicheng.lin@intel.com
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
(cherry picked from commit 78a6c5f899f22338bbf48b44fb8950409c5a69b9)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/gpu/drm/xe/xe_dma_buf.c