Re: [PATCH 4/4] drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()

[Matthew Brost <matthew.brost@intel.com>]

On Tue, Apr 07, 2026 at 08:15:42PM +0000, Shuicheng Lin wrote:
> When xe_dma_buf_init_obj() fails, the attachment from
> dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before
> returning the error. Note: we cannot use goto out_err here because
> xe_dma_buf_init_obj() already frees bo on failure, and out_err would
> double-free it.
> 
> Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4.6
> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_dma_buf.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c
> index 24d9d82426b9..7702a6bdaae5 100644
> --- a/drivers/gpu/drm/xe/xe_dma_buf.c
> +++ b/drivers/gpu/drm/xe/xe_dma_buf.c
> @@ -370,12 +370,15 @@ struct drm_gem_object *xe_gem_prime_import(struct drm_device *dev,
>  		goto out_err;
>  	}
>  
> -	/* Errors here will take care of freeing the bo. */
> +	/*
> +	 * xe_dma_buf_init_obj() takes ownership of bo on both success
> +	 * and failure, so we must not touch bo after this call.
> +	 */
>  	obj = xe_dma_buf_init_obj(dev, bo, dma_buf);
> -	if (IS_ERR(obj))
> +	if (IS_ERR(obj)) {
> +		dma_buf_detach(dma_buf, attach);

Based on my feedback from the previous patch [1], I think we also want...

		xe_bo_free(bo);

Also unseen in this diff is this code:

365         attach = dma_buf_dynamic_attach(dma_buf, dev->dev, attach_ops, &bo->ttm.base);
366         if (IS_ERR(attach)) {
367                 obj = ERR_CAST(attach);
368                 goto out_err;
369         }

We also need a xe_bo_free(bo) in this failures if statement.

Matt

[1] https://patchwork.freedesktop.org/patch/716820/?series=164476&rev=1#comment_1319810

>  		return obj;
> -
> -
> +	}
>  	get_dma_buf(dma_buf);
>  	obj->import_attach = attach;
>  	return obj;
> -- 
> 2.43.0
>