Re: [PATCH V1] accel/amdxdna: fix open_ref leak and stale client pointer on dma map failure

[Lizhi Hou <lizhi.hou@amd.com>]

Applied to drm-misc-fixes

On 7/7/26 08:09, Max Zhen wrote:
>
>
> On 7/6/2026 Mon 22:56, Lizhi Hou wrote:
>> amdxdna_gem_obj_open() increments open_ref before attempting to set up
>> the DMA address mapping.  When amdxdna_dma_map_bo() fails, the function
>> returned immediately without rolling back either change made on the 
>> first
>> open (open_ref == 1 path).
>>
>> Fix it by decrementing open_ref and clearing abo->client on the error 
>> path.
>>
>> Fixes: ece3e8980907 ("accel/amdxdna: Allow forcing IOVA-based DMA via 
>> module parameter")
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> Reviewed-by: Max Zhen <max.zhen@amd.com>
>> ---
>>   drivers/accel/amdxdna/amdxdna_gem.c | 5 ++++-
>>   1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/accel/amdxdna/amdxdna_gem.c 
>> b/drivers/accel/amdxdna/amdxdna_gem.c
>> index a4bd9e86bc8d..3f03d2db1603 100644
>> --- a/drivers/accel/amdxdna/amdxdna_gem.c
>> +++ b/drivers/accel/amdxdna/amdxdna_gem.c
>> @@ -663,8 +663,11 @@ static int amdxdna_gem_obj_open(struct 
>> drm_gem_object *gobj, struct drm_file *fi
>>       /* No need to set up dma addr mapping in PASID mode. */
>>       if (!amdxdna_pasid_on(abo->client)) {
>>           ret = amdxdna_dma_map_bo(xdna, abo);
>> -        if (ret)
>> +        if (ret) {
>> +            abo->open_ref--;
>> +            abo->client = NULL;
>>               return ret;
>> +        }
>>       }
>>         amdxdna_gem_add_bo_usage(abo);
>