Re: [PATCH v2] drm/virtio: Put GEM objects when dropping a vbuf without queueing it

[sashiko-bot@kernel.org]

> From: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
> 
> virtio_gpu_queue_ctrl_sgs() drops the command when drm_dev_enter()
> fails or when vqs_released is set during device removal. It unlocks the
> reservations and frees the vbuf, but never releases the GEM object
> references that the caller transferred in vbuf->objs. Those references
> are normally dropped by the dequeue worker once the host completes the
> command, which never happens for a command that was not queued.
> 
> If a framebuffer flush or transfer (e.g. the fbdev damage worker) races
> with device removal, the GEM object backing the buffer keeps a stale
> reference and is never freed. GEM objects do not hold a reference on the
> drm_device, so the device is still released, with the object's node left
> in the vma offset manager:
> 
> [ ... ]
> Link: https://lore.kernel.org/all/20260927040655.14531-1-ngocthang2710.1999@gmail.com/
> Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
> [fei.yu: also handle the vmalloc_to_sgt() failure path, pass the fence
>  to the helper instead of a bool, fix the Fixes tags]
> Signed-off-by: Fei Yu <fei.yu@intel.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103085314.3102802-1-fei.yu@intel.com?part=1