From: Boris Brezillon Date: Tue, 6 Jan 2026 16:49:35 +0000 (+0100) Subject: drm/gem: Fix a GEM leak in drm_gem_get_unmapped_area() X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5f8d6f29c51ab8572fc1d3891952ca445e75a610;p=thirdparty%2Fkernel%2Flinux.git drm/gem: Fix a GEM leak in drm_gem_get_unmapped_area() drm_gem_object_lookup_at_offset() can return a valid object with filp or filp->f_op->get_unmapped_area set to NULL. Make sure we still release the ref we acquired on such objects. Cc: Loïc Molinari Fixes: 99bda20d6d4c ("drm/gem: Introduce drm_gem_get_unmapped_area() fop") Reviewed-by: Loïc Molinari Link: https://patch.msgid.link/20260106164935.409765-1-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon --- diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 36c8af123877..f7cbf6e8d1e0 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -1298,11 +1298,13 @@ unsigned long drm_gem_get_unmapped_area(struct file *filp, unsigned long uaddr, unsigned long ret; obj = drm_gem_object_lookup_at_offset(filp, pgoff, len >> PAGE_SHIFT); - if (IS_ERR(obj) || !obj->filp || !obj->filp->f_op->get_unmapped_area) - return mm_get_unmapped_area(filp, uaddr, len, 0, flags); + if (IS_ERR(obj)) + obj = NULL; - ret = obj->filp->f_op->get_unmapped_area(obj->filp, uaddr, len, 0, - flags); + if (!obj || !obj->filp || !obj->filp->f_op->get_unmapped_area) + ret = mm_get_unmapped_area(filp, uaddr, len, 0, flags); + else + ret = obj->filp->f_op->get_unmapped_area(obj->filp, uaddr, len, 0, flags); drm_gem_object_put(obj);