* [PATCH V1] accel/amdxdna: fix open_ref leak and stale client pointer on dma map failure
@ 2026-07-07 5:56 Lizhi Hou
2026-07-07 15:09 ` Max Zhen
0 siblings, 1 reply; 3+ messages in thread
From: Lizhi Hou @ 2026-07-07 5:56 UTC (permalink / raw)
To: ogabbay, quic_jhugo, dri-devel, mario.limonciello,
karol.wachowski
Cc: Lizhi Hou, linux-kernel, max.zhen, sonal.santan
amdxdna_gem_obj_open() increments open_ref before attempting to set up
the DMA address mapping. When amdxdna_dma_map_bo() fails, the function
returned immediately without rolling back either change made on the first
open (open_ref == 1 path).
Fix it by decrementing open_ref and clearing abo->client on the error path.
Fixes: ece3e8980907 ("accel/amdxdna: Allow forcing IOVA-based DMA via module parameter")
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
drivers/accel/amdxdna/amdxdna_gem.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
index a4bd9e86bc8d..3f03d2db1603 100644
--- a/drivers/accel/amdxdna/amdxdna_gem.c
+++ b/drivers/accel/amdxdna/amdxdna_gem.c
@@ -663,8 +663,11 @@ static int amdxdna_gem_obj_open(struct drm_gem_object *gobj, struct drm_file *fi
/* No need to set up dma addr mapping in PASID mode. */
if (!amdxdna_pasid_on(abo->client)) {
ret = amdxdna_dma_map_bo(xdna, abo);
- if (ret)
+ if (ret) {
+ abo->open_ref--;
+ abo->client = NULL;
return ret;
+ }
}
amdxdna_gem_add_bo_usage(abo);
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH V1] accel/amdxdna: fix open_ref leak and stale client pointer on dma map failure
2026-07-07 5:56 [PATCH V1] accel/amdxdna: fix open_ref leak and stale client pointer on dma map failure Lizhi Hou
@ 2026-07-07 15:09 ` Max Zhen
2026-07-07 17:12 ` Lizhi Hou
0 siblings, 1 reply; 3+ messages in thread
From: Max Zhen @ 2026-07-07 15:09 UTC (permalink / raw)
To: Lizhi Hou, ogabbay, quic_jhugo, dri-devel, mario.limonciello,
karol.wachowski
Cc: linux-kernel, sonal.santan
On 7/6/2026 Mon 22:56, Lizhi Hou wrote:
> amdxdna_gem_obj_open() increments open_ref before attempting to set up
> the DMA address mapping. When amdxdna_dma_map_bo() fails, the function
> returned immediately without rolling back either change made on the first
> open (open_ref == 1 path).
>
> Fix it by decrementing open_ref and clearing abo->client on the error path.
>
> Fixes: ece3e8980907 ("accel/amdxdna: Allow forcing IOVA-based DMA via module parameter")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Max Zhen <max.zhen@amd.com>
> ---
> drivers/accel/amdxdna/amdxdna_gem.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
> index a4bd9e86bc8d..3f03d2db1603 100644
> --- a/drivers/accel/amdxdna/amdxdna_gem.c
> +++ b/drivers/accel/amdxdna/amdxdna_gem.c
> @@ -663,8 +663,11 @@ static int amdxdna_gem_obj_open(struct drm_gem_object *gobj, struct drm_file *fi
> /* No need to set up dma addr mapping in PASID mode. */
> if (!amdxdna_pasid_on(abo->client)) {
> ret = amdxdna_dma_map_bo(xdna, abo);
> - if (ret)
> + if (ret) {
> + abo->open_ref--;
> + abo->client = NULL;
> return ret;
> + }
> }
>
> amdxdna_gem_add_bo_usage(abo);
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH V1] accel/amdxdna: fix open_ref leak and stale client pointer on dma map failure
2026-07-07 15:09 ` Max Zhen
@ 2026-07-07 17:12 ` Lizhi Hou
0 siblings, 0 replies; 3+ messages in thread
From: Lizhi Hou @ 2026-07-07 17:12 UTC (permalink / raw)
To: Max Zhen, ogabbay, quic_jhugo, dri-devel, mario.limonciello,
karol.wachowski
Cc: linux-kernel, sonal.santan
Applied to drm-misc-fixes
On 7/7/26 08:09, Max Zhen wrote:
>
>
> On 7/6/2026 Mon 22:56, Lizhi Hou wrote:
>> amdxdna_gem_obj_open() increments open_ref before attempting to set up
>> the DMA address mapping. When amdxdna_dma_map_bo() fails, the function
>> returned immediately without rolling back either change made on the
>> first
>> open (open_ref == 1 path).
>>
>> Fix it by decrementing open_ref and clearing abo->client on the error
>> path.
>>
>> Fixes: ece3e8980907 ("accel/amdxdna: Allow forcing IOVA-based DMA via
>> module parameter")
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> Reviewed-by: Max Zhen <max.zhen@amd.com>
>> ---
>> drivers/accel/amdxdna/amdxdna_gem.c | 5 ++++-
>> 1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/accel/amdxdna/amdxdna_gem.c
>> b/drivers/accel/amdxdna/amdxdna_gem.c
>> index a4bd9e86bc8d..3f03d2db1603 100644
>> --- a/drivers/accel/amdxdna/amdxdna_gem.c
>> +++ b/drivers/accel/amdxdna/amdxdna_gem.c
>> @@ -663,8 +663,11 @@ static int amdxdna_gem_obj_open(struct
>> drm_gem_object *gobj, struct drm_file *fi
>> /* No need to set up dma addr mapping in PASID mode. */
>> if (!amdxdna_pasid_on(abo->client)) {
>> ret = amdxdna_dma_map_bo(xdna, abo);
>> - if (ret)
>> + if (ret) {
>> + abo->open_ref--;
>> + abo->client = NULL;
>> return ret;
>> + }
>> }
>> amdxdna_gem_add_bo_usage(abo);
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-07 17:12 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-07 5:56 [PATCH V1] accel/amdxdna: fix open_ref leak and stale client pointer on dma map failure Lizhi Hou
2026-07-07 15:09 ` Max Zhen
2026-07-07 17:12 ` Lizhi Hou
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox