Unverified Commit 1d0adf2f authored by Shuicheng Lin's avatar Shuicheng Lin Committed by Rodrigo Vivi
Browse files

drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() 



When XE_BO_FLAG_GGTT_ALL is set without XE_BO_FLAG_GGTT, the function
returns an error without freeing a caller-provided bo, violating the
documented contract that bo is freed on failure.

Add xe_bo_free(bo) before returning the error.

Fixes: 5a3b0df2 ("drm/xe: Allow bo mapping on multiple ggtts")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: default avatarMatthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260408175255.3402838-3-shuicheng.lin@intel.com


Signed-off-by: default avatarShuicheng Lin <shuicheng.lin@intel.com>
(cherry picked from commit 3fbd6cf43cac7b60757f3ce3d95195d3843a902c)
Signed-off-by: default avatarRodrigo Vivi <rodrigo.vivi@intel.com>
parent 09a8f3c1

drivers/gpu/drm/xe/xe_bo.c

+3 −1
Original line number Diff line number Diff line
@@ -2322,8 +2322,10 @@ struct xe_bo *xe_bo_init_locked(struct xe_device *xe, struct xe_bo *bo, 
	}



	/* XE_BO_FLAG_GGTTx requires XE_BO_FLAG_GGTT also be set */

	if ((flags & XE_BO_FLAG_GGTT_ALL) && !(flags & XE_BO_FLAG_GGTT))

	if ((flags & XE_BO_FLAG_GGTT_ALL) && !(flags & XE_BO_FLAG_GGTT)) {

		xe_bo_free(bo);

		return ERR_PTR(-EINVAL);

	}



	if (flags & (XE_BO_FLAG_VRAM_MASK | XE_BO_FLAG_STOLEN) &&

	    !(flags & XE_BO_FLAG_IGNORE_MIN_PAGE_SIZE) &&