Unverified Commit 111ab678 authored by Shuicheng Lin's avatar Shuicheng Lin Committed by Rodrigo Vivi
Browse files

drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() 



When xe_dma_buf_init_obj() fails, the attachment from
dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before
returning the error. Note: we cannot use goto out_err here because
xe_dma_buf_init_obj() already frees bo on failure, and out_err would
double-free it.

Fixes: dd08ebf6 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: default avatarMattheq Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260408175255.3402838-5-shuicheng.lin@intel.com


Signed-off-by: default avatarShuicheng Lin <shuicheng.lin@intel.com>
(cherry picked from commit a828eb185aac41800df8eae4b60501ccc0dbbe51)
Signed-off-by: default avatarRodrigo Vivi <rodrigo.vivi@intel.com>
parent 93a528f6

drivers/gpu/drm/xe/xe_dma_buf.c

+7 −4
Original line number Diff line number Diff line
@@ -378,12 +378,15 @@ struct drm_gem_object *xe_gem_prime_import(struct drm_device *dev, 
		goto out_err;

	}



	/* Errors here will take care of freeing the bo. */

	/*

	 * xe_dma_buf_init_obj() takes ownership of bo on both success

	 * and failure, so we must not touch bo after this call.

	 */

	obj = xe_dma_buf_init_obj(dev, bo, dma_buf);

	if (IS_ERR(obj))

	if (IS_ERR(obj)) {

		dma_buf_detach(dma_buf, attach);

		return obj;





	}

	get_dma_buf(dma_buf);

	obj->import_attach = attach;

	return obj;