Re: [PATCH 1/4] drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()

[Matthew Brost <matthew.brost@intel.com>]

On Tue, Apr 07, 2026 at 08:15:39PM +0000, Shuicheng Lin wrote:
> When type is ttm_bo_type_device and aligned_size != size, the function
> returns an error without freeing a caller-provided bo, violating the
> documented contract that bo is freed on failure.
> 
> Add xe_bo_free(bo) before returning the error.
> 
> Fixes: 4e03b584143e ("drm/xe/uapi: Reject bo creation of unaligned size")
> Cc: stable@vger.kernel.org

Reviewed-by: Matthew Brost <matthew.brost@intel.com>

> Assisted-by: Claude:claude-opus-4.6
> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_bo.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> index b70e8396e56f..6e4ebbe72952 100644
> --- a/drivers/gpu/drm/xe/xe_bo.c
> +++ b/drivers/gpu/drm/xe/xe_bo.c
> @@ -2342,8 +2342,10 @@ struct xe_bo *xe_bo_init_locked(struct xe_device *xe, struct xe_bo *bo,
>  		alignment = SZ_4K >> PAGE_SHIFT;
>  	}
>  
> -	if (type == ttm_bo_type_device && aligned_size != size)
> +	if (type == ttm_bo_type_device && aligned_size != size) {
> +		xe_bo_free(bo);
>  		return ERR_PTR(-EINVAL);
> +	}
>  
>  	if (!bo) {
>  		bo = xe_bo_alloc();
> -- 
> 2.43.0
>