Re: [PATCH 2/4] drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()

Matthew Brost
2026-04-08T04:54:15Z

On Tue, Apr 07, 2026 at 08:15:40PM +0000, Shuicheng Lin wrote:
> When XE_BO_FLAG_GGTT_ALL is set without XE_BO_FLAG_GGTT, the function
> returns an error without freeing a caller-provided bo, violating the
> documented contract that bo is freed on failure.
>
> Add xe_bo_free(bo) before returning the error.
>
> Fixes: 5a3b0df25d6a ("drm/xe: Allow bo mapping on multiple ggtts")
> Cc: stable@vger.kernel.org

Reviewed-by: Matthew Brost <matthew.brost@intel.com>

> Assisted-by: Claude:claude-opus-4.6
> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
> ---
> drivers/gpu/drm/xe/xe_bo.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> index 6e4ebbe72952..d09e96b996b9 100644
> --- a/drivers/gpu/drm/xe/xe_bo.c
> +++ b/drivers/gpu/drm/xe/xe_bo.c
> @@ -2322,8 +2322,10 @@ struct xe_bo *xe_bo_init_locked(struct xe_device *xe, struct xe_bo *bo,
> }
>
> /* XE_BO_FLAG_GGTTx requires XE_BO_FLAG_GGTT also be set */
> - if ((flags & XE_BO_FLAG_GGTT_ALL) && !(flags & XE_BO_FLAG_GGTT))
> + if ((flags & XE_BO_FLAG_GGTT_ALL) && !(flags & XE_BO_FLAG_GGTT)) {
> + xe_bo_free(bo);
> return ERR_PTR(-EINVAL);
> + }
>
> if (flags & (XE_BO_FLAG_VRAM_MASK | XE_BO_FLAG_STOLEN) &&
> !(flags & XE_BO_FLAG_IGNORE_MIN_PAGE_SIZE) &&
> --
> 2.43.0
>