tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()

When type is ttm_bo_type_device and aligned_size != size, the function
returns an error without freeing a caller-provided bo, violating the
documented contract that bo is freed on failure.

Add xe_bo_free(bo) before returning the error.

Fixes: 4e03b584143e ("drm/xe/uapi: Reject bo creation of unaligned size")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260408175255.3402838-2-shuicheng.lin@intel.com
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
(cherry picked from commit 601c2aa087b6f21014300a3f107a08ee4dde7bdf)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

authored by

Shuicheng Lin and committed by
Rodrigo Vivi 09a8f3c1 f8c4151d

+3 -1
+3 -1
drivers/gpu/drm/xe/xe_bo.c
··· 2342 2342 alignment = SZ_4K >> PAGE_SHIFT; 2343 2343 } 2344 2344 2345 - if (type == ttm_bo_type_device && aligned_size != size) 2345 + if (type == ttm_bo_type_device && aligned_size != size) { 2346 + xe_bo_free(bo); 2346 2347 return ERR_PTR(-EINVAL); 2348 + } 2347 2349 2348 2350 if (!bo) { 2349 2351 bo = xe_bo_alloc();