Public
> -----Original Message-----
> From: Wentao Liang <[email protected]>
> Sent: Wednesday, September 16, 2026 5:53 AM
> To: Francis, David <[email protected]>
> Cc: [email protected]; Deucher, Alexander <[email protected]>;
> [email protected]; Koenig, Christian
> <[email protected]>; [email protected]; linux-
> [email protected]; [email protected]; Wentao Liang <[email protected]>;
> [email protected]
> Subject: [PATCH] drm/amdgpu: Fix GEM object leak in
> amdgpu_gem_op_ioctl()
>
> In the AMDGPU_GEM_OP_GET_MAPPING_INFO case,
> amdgpu_gem_op_ioctl() takes a reference to the GEM object with
> drm_gem_object_lookup() and holds the buffer object locked through
> drm_exec. When the allocation of the mapping array fails, the function
> returns -ENOMEM directly, leaving the exec locks held and leaking the GEM
> object reference returned by drm_gem_object_lookup().
>
> Jump to the out_exec label instead so that drm_exec_fini() and
> drm_gem_object_put() release the locks and the GEM object reference.
>
> Fixes: 4d82724f7f2b ("drm/amdgpu: Add mapping info option for GEM_OP
> ioctl")
> Cc: [email protected]
> Signed-off-by: Wentao Liang <[email protected]>
This was already fixed.
Thanks,
Alex
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
> index 123d4a09114d..06dd2e8a5b47 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
> @@ -1094,8 +1094,10 @@ int amdgpu_gem_op_ioctl(struct drm_device
> *dev, void *data,
> * be retried.
> */
> vm_entries = kvcalloc(args->num_entries,
> sizeof(*vm_entries), GFP_KERNEL);
> - if (!vm_entries)
> - return -ENOMEM;
> + if (!vm_entries) {
> + r = -ENOMEM;
> + goto out_exec;
> + }
>
> amdgpu_vm_bo_va_for_each_valid_mapping(bo_va,
> mapping) {
> if (num_mappings < args->num_entries) {
> --
> 2.34.1
