RE: [PATCH 4/4] drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()

Lin, Shuicheng
2026-04-08T17:34:38Z

On Tue, Apr 7, 2026 10:05 PM Matthew Brost wrote:
> On Tue, Apr 07, 2026 at 08:15:42PM +0000, Shuicheng Lin wrote:
> > When xe_dma_buf_init_obj() fails, the attachment from
> > dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before
> > returning the error. Note: we cannot use goto out_err here because
> > xe_dma_buf_init_obj() already frees bo on failure, and out_err would
> > double-free it.
> >
> > Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel
> > GPUs")
> > Cc: stable@vger.kernel.org
> > Assisted-by: Claude:claude-opus-4.6
> > Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
> > ---
> > drivers/gpu/drm/xe/xe_dma_buf.c | 11 +++++++----
> > 1 file changed, 7 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c
> > b/drivers/gpu/drm/xe/xe_dma_buf.c index 24d9d82426b9..7702a6bdaae5
> > 100644
> > --- a/drivers/gpu/drm/xe/xe_dma_buf.c
> > +++ b/drivers/gpu/drm/xe/xe_dma_buf.c
> > @@ -370,12 +370,15 @@ struct drm_gem_object
> *xe_gem_prime_import(struct drm_device *dev,
> > goto out_err;
> > }
> >
> > - /* Errors here will take care of freeing the bo. */
> > + /*
> > + * xe_dma_buf_init_obj() takes ownership of bo on both success
> > + * and failure, so we must not touch bo after this call.
> > + */
> > obj = xe_dma_buf_init_obj(dev, bo, dma_buf);
> > - if (IS_ERR(obj))
> > + if (IS_ERR(obj)) {
> > + dma_buf_detach(dma_buf, attach);
>
> Based on my feedback from the previous patch [1], I think we also want...
>
> xe_bo_free(bo);
>
> Also unseen in this diff is this code:
>
> 365 attach = dma_buf_dynamic_attach(dma_buf, dev->dev, attach_ops,
> &bo->ttm.base);
> 366 if (IS_ERR(attach)) {
> 367 obj = ERR_CAST(attach);
> 368 goto out_err;
> 369 }
>
> We also need a xe_bo_free(bo) in this failures if statement.
>
> Matt
>
> [1]
> https://patchwork.freedesktop.org/patch/716820/?series=164476&rev=1#c
> omment_1319810
>

As discussed in another email, could you please help me review this patch again?
Thanks.

Shuicheng

> > return obj;
> > -
> > -
> > + }
> > get_dma_buf(dma_buf);
> > obj->import_attach = attach;
> > return obj;
> > --
> > 2.43.0
> >