Re: [PATCH 4/4] drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()

Matthew Brost
2026-04-08T17:38:17Z

On Wed, Apr 08, 2026 at 11:34:28AM -0600, Lin, Shuicheng wrote:
> On Tue, Apr 7, 2026 10:05 PM Matthew Brost wrote:
> > On Tue, Apr 07, 2026 at 08:15:42PM +0000, Shuicheng Lin wrote:
> > > When xe_dma_buf_init_obj() fails, the attachment from
> > > dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before
> > > returning the error. Note: we cannot use goto out_err here because
> > > xe_dma_buf_init_obj() already frees bo on failure, and out_err would
> > > double-free it.
> > >
> > > Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel
> > > GPUs")
> > > Cc: stable@vger.kernel.org
> > > Assisted-by: Claude:claude-opus-4.6
> > > Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
> > > ---
> > > drivers/gpu/drm/xe/xe_dma_buf.c | 11 +++++++----
> > > 1 file changed, 7 insertions(+), 4 deletions(-)
> > >
> > > diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c
> > > b/drivers/gpu/drm/xe/xe_dma_buf.c index 24d9d82426b9..7702a6bdaae5
> > > 100644
> > > --- a/drivers/gpu/drm/xe/xe_dma_buf.c
> > > +++ b/drivers/gpu/drm/xe/xe_dma_buf.c
> > > @@ -370,12 +370,15 @@ struct drm_gem_object
> > *xe_gem_prime_import(struct drm_device *dev,
> > > goto out_err;
> > > }
> > >
> > > - /* Errors here will take care of freeing the bo. */
> > > + /*
> > > + * xe_dma_buf_init_obj() takes ownership of bo on both success
> > > + * and failure, so we must not touch bo after this call.
> > > + */
> > > obj = xe_dma_buf_init_obj(dev, bo, dma_buf);
> > > - if (IS_ERR(obj))
> > > + if (IS_ERR(obj)) {
> > > + dma_buf_detach(dma_buf, attach);
> >
> > Based on my feedback from the previous patch [1], I think we also want...
> >
> > xe_bo_free(bo);
> >
> > Also unseen in this diff is this code:
> >
> > 365 attach = dma_buf_dynamic_attach(dma_buf, dev->dev, attach_ops,
> > &bo->ttm.base);
> > 366 if (IS_ERR(attach)) {
> > 367 obj = ERR_CAST(attach);
> > 368 goto out_err;
> > 369 }
> >
> > We also need a xe_bo_free(bo) in this failures if statement.
> >
> > Matt

^^^ Ignore all of this. Missed out_err calls xe_bo_free too.

So patch LGTM:
Reviewed-by: Mattheq Brost <matthew.brost@intel.com>

> >
> > [1]
> > https://patchwork.freedesktop.org/patch/716820/?series=164476&rev=1#c
> > omment_1319810
> >
>
> As discussed in another email, could you please help me review this patch again?
> Thanks.
>
> Shuicheng
>
> > > return obj;
> > > -
> > > -
> > > + }
> > > get_dma_buf(dma_buf);
> > > obj->import_attach = attach;
> > > return obj;
> > > --
> > > 2.43.0
> > >