diff options
| author | Junrui Luo <moonafterrain@outlook.com> | 2026-09-15 15:39:13 +0800 |
|---|---|---|
| committer | Dmitry Osipenko <dmitry.osipenko@collabora.com> | 2026-09-20 20:48:52 +0300 |
| commit | 036d28db1818af2f9d80db771f5405da84d7732d (patch) | |
| tree | cb559e942840fc55cb88b36b16ce122ef0896192 /tools/perf/scripts/python/stackcollapse.py | |
| parent | 24b6d5c7641412c9ebef0d4c8b888d49a0e6b880 (diff) | |
| download | linux-next-036d28db1818af2f9d80db771f5405da84d7732d.tar.gz linux-next-036d28db1818af2f9d80db771f5405da84d7732d.zip | |
drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
virtio_gpu_vram_create() frees the object with a bare kfree(vram) on
both error paths after drm_gem_private_object_init() has run, and on the
second one after drm_gem_create_mmap_offset() has linked obj->vma_node
into the device's VMA offset manager. The freed object stays in that
interval tree, so a later lookup or insertion walks freed memory, and
the dma_resv and gpuva lock are never destroyed.
Call drm_gem_object_release() before kfree() on both paths.
Fixes: 16845c5d5409 ("drm/virtio: implement blob resources: implement vram object")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Link: https://patch.msgid.link/20260915-fixes-v2-4-a0d799e4db66@outlook.com
Diffstat (limited to 'tools/perf/scripts/python/stackcollapse.py')
0 files changed, 0 insertions, 0 deletions