tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()

When xe_dma_buf_init_obj() fails, the attachment from
dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before
returning the error. Note: we cannot use goto out_err here because
xe_dma_buf_init_obj() already frees bo on failure, and out_err would
double-free it.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: Mattheq Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260408175255.3402838-5-shuicheng.lin@intel.com
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
(cherry picked from commit a828eb185aac41800df8eae4b60501ccc0dbbe51)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

authored by

Shuicheng Lin and committed by
Rodrigo Vivi 111ab678 93a528f6

+7 -4
+7 -4
drivers/gpu/drm/xe/xe_dma_buf.c
··· 378 378 goto out_err; 379 379 } 380 380 381 - /* Errors here will take care of freeing the bo. */ 381 + /* 382 + * xe_dma_buf_init_obj() takes ownership of bo on both success 383 + * and failure, so we must not touch bo after this call. 384 + */ 382 385 obj = xe_dma_buf_init_obj(dev, bo, dma_buf); 383 - if (IS_ERR(obj)) 386 + if (IS_ERR(obj)) { 387 + dma_buf_detach(dma_buf, attach); 384 388 return obj; 385 - 386 - 389 + } 387 390 get_dma_buf(dma_buf); 388 391 obj->import_attach = attach; 389 392 return obj;