Re: [PATCH v3] drm/xe: Fix memory leak in xe_vm_madvise_ioctl

[Matthew Brost <matthew.brost@intel.com>]

On Mon, Feb 23, 2026 at 11:21:45PM +0530, Varun Gupta wrote:
> When check_bo_args_are_sane() validation fails, jump to the new
> free_vmas cleanup label to properly free the allocated resources.
> This ensures proper cleanup in this error path.
> 
> Fixes: 293032eec4ba ("drm/xe/bo: Update atomic_access attribute on madvise")
> Cc: stable@vger.kernel.org # v6.18+
> Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com>

Reviewed-by: Matthew Brost <matthew.brost@intel.com>

> Signed-off-by: Varun Gupta <varun.gupta@intel.com>
> ---
> v3:
>  - Corrected Fixes tag to 293032eec4ba (Shuicheng Lin)
> v2:
>  - Added Fixes tag and Cc stable (Matt Brost)
> ---
>  drivers/gpu/drm/xe/xe_vm_madvise.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_vm_madvise.c b/drivers/gpu/drm/xe/xe_vm_madvise.c
> index 52147f5eaaa0..0c92fed6c6a6 100644
> --- a/drivers/gpu/drm/xe/xe_vm_madvise.c
> +++ b/drivers/gpu/drm/xe/xe_vm_madvise.c
> @@ -453,7 +453,7 @@ int xe_vm_madvise_ioctl(struct drm_device *dev, void *data, struct drm_file *fil
>  						    madvise_range.num_vmas,
>  						    args->atomic.val)) {
>  				err = -EINVAL;
> -				goto madv_fini;
> +				goto free_vmas;
>  			}
>  		}
>  
> @@ -490,6 +490,7 @@ int xe_vm_madvise_ioctl(struct drm_device *dev, void *data, struct drm_file *fil
>  err_fini:
>  	if (madvise_range.has_bo_vmas)
>  		drm_exec_fini(&exec);
> +free_vmas:
>  	kfree(madvise_range.vmas);
>  	madvise_range.vmas = NULL;
>  madv_fini:
> -- 
> 2.43.0
>