drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()

commit 111ab678471bf1f90d078d5513bb086b70596c3c upstream.

When xe_dma_buf_init_obj() fails, the attachment from
dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before
returning the error. Note: we cannot use goto out_err here because
xe_dma_buf_init_obj() already frees bo on failure, and out_err would
double-free it.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: Mattheq Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260408175255.3402838-5-shuicheng.lin@intel.com
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
(cherry picked from commit a828eb185aac41800df8eae4b60501ccc0dbbe51)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c
index 43d1e01c8012647328590a850a610b0277e39b95..19a8aba33085ec8af7079e8c376d6700f4997a81 100644 (file)
--- a/drivers/gpu/drm/xe/xe_dma_buf.c
+++ b/drivers/gpu/drm/xe/xe_dma_buf.c
@@ -358,12 +358,15 @@ struct drm_gem_object *xe_gem_prime_import(struct drm_device *dev,
                goto out_err;
        }
 
-       /* Errors here will take care of freeing the bo. */
+       /*
+        * xe_dma_buf_init_obj() takes ownership of bo on both success
+        * and failure, so we must not touch bo after this call.
+        */
        obj = xe_dma_buf_init_obj(dev, bo, dma_buf);
-       if (IS_ERR(obj))
+       if (IS_ERR(obj)) {
+               dma_buf_detach(dma_buf, attach);
                return obj;
-
-
+       }
        get_dma_buf(dma_buf);
        obj->import_attach = attach;
        return obj;