Re: [PATCH 4/4] drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()

[Matthew Brost <matthew.brost@intel.com>]

On Wed, Apr 08, 2026 at 11:34:28AM -0600, Lin, Shuicheng wrote:
> On Tue, Apr 7, 2026 10:05 PM Matthew Brost wrote:
> > On Tue, Apr 07, 2026 at 08:15:42PM +0000, Shuicheng Lin wrote:
> > > When xe_dma_buf_init_obj() fails, the attachment from
> > > dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before
> > > returning the error. Note: we cannot use goto out_err here because
> > > xe_dma_buf_init_obj() already frees bo on failure, and out_err would
> > > double-free it.
> > >
> > > Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel
> > > GPUs")
> > > Cc: stable@vger.kernel.org
> > > Assisted-by: Claude:claude-opus-4.6
> > > Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
> > > ---
> > >  drivers/gpu/drm/xe/xe_dma_buf.c | 11 +++++++----
> > >  1 file changed, 7 insertions(+), 4 deletions(-)
> > >
> > > diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c
> > > b/drivers/gpu/drm/xe/xe_dma_buf.c index 24d9d82426b9..7702a6bdaae5
> > > 100644
> > > --- a/drivers/gpu/drm/xe/xe_dma_buf.c
> > > +++ b/drivers/gpu/drm/xe/xe_dma_buf.c
> > > @@ -370,12 +370,15 @@ struct drm_gem_object
> > *xe_gem_prime_import(struct drm_device *dev,
> > >  		goto out_err;
> > >  	}
> > >
> > > -	/* Errors here will take care of freeing the bo. */
> > > +	/*
> > > +	 * xe_dma_buf_init_obj() takes ownership of bo on both success
> > > +	 * and failure, so we must not touch bo after this call.
> > > +	 */
> > >  	obj = xe_dma_buf_init_obj(dev, bo, dma_buf);
> > > -	if (IS_ERR(obj))
> > > +	if (IS_ERR(obj)) {
> > > +		dma_buf_detach(dma_buf, attach);
> > 
> > Based on my feedback from the previous patch [1], I think we also want...
> > 
> > 		xe_bo_free(bo);
> > 
> > Also unseen in this diff is this code:
> > 
> > 365         attach = dma_buf_dynamic_attach(dma_buf, dev->dev, attach_ops,
> > &bo->ttm.base);
> > 366         if (IS_ERR(attach)) {
> > 367                 obj = ERR_CAST(attach);
> > 368                 goto out_err;
> > 369         }
> > 
> > We also need a xe_bo_free(bo) in this failures if statement.
> > 
> > Matt

^^^ Ignore all of this. Missed out_err calls xe_bo_free too.

So patch LGTM:
Reviewed-by: Mattheq Brost <matthew.brost@intel.com>

> > 
> > [1]
> > https://patchwork.freedesktop.org/patch/716820/?series=164476&rev=1#c
> > omment_1319810
> > 
> 
> As discussed in another email, could you please help me	review this patch again?
> Thanks.
> 
> Shuicheng
> 
> > >  		return obj;
> > > -
> > > -
> > > +	}
> > >  	get_dma_buf(dma_buf);
> > >  	obj->import_attach = attach;
> > >  	return obj;
> > > --
> > > 2.43.0
> > >