diff options
| author | Wentao Liang <vulab@iscas.ac.cn> | 2026-09-16 17:57:38 +0000 |
|---|---|---|
| committer | Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> | 2026-10-01 04:35:29 +0300 |
| commit | ab91ba61871a896ca2ecc6e048d80a152136da44 (patch) | |
| tree | 17e853344e6cfb13e92bcbb344a841ea7b7a4f77 | |
| parent | c33cee4c07f1533ad48ed8e3eef75df57edf44c1 (diff) | |
| download | linux-next-ab91ba61871a896ca2ecc6e048d80a152136da44.tar.gz linux-next-ab91ba61871a896ca2ecc6e048d80a152136da44.zip | |
drm/msm/dsi: Fix VM leak in dsi_tx_buf_alloc_6g()
dsi_tx_buf_alloc_6g() takes a reference to the kms VM with
drm_gpuvm_get() and stores it in msm_host->vm. If
msm_gem_kernel_new() fails, the function returns early without
dropping that reference. Since msm_host->tx_gem_obj is cleared on
the error path, msm_dsi_tx_buf_free() will never see a non-NULL
tx_gem_obj and thus never calls drm_gpuvm_put(), leaking the VM
reference.
Drop the VM reference and clear msm_host->vm on the error path.
Fixes: 5e05be782645 ("drm/msm/dsi: free TX buffer in unbind")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Rob Clark <rob.clark@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/754332/
Link: https://lore.kernel.org/r/20260916175738.2089950-1-vulab@iscas.ac.cn
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
| -rw-r--r-- | drivers/gpu/drm/msm/dsi/dsi_host.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c index b292dfd266d1..d92659d80f17 100644 --- a/drivers/gpu/drm/msm/dsi/dsi_host.c +++ b/drivers/gpu/drm/msm/dsi/dsi_host.c @@ -1254,6 +1254,8 @@ int dsi_tx_buf_alloc_6g(struct msm_dsi_host *msm_host, int size) if (IS_ERR(data)) { msm_host->tx_gem_obj = NULL; + drm_gpuvm_put(msm_host->vm); + msm_host->vm = NULL; return PTR_ERR(data); } |