On 9/17/2026 12:00 PM, Wentao Liang wrote:
If drm_gem_handle_create() fails, it takes and then releases its handle reference internally, leaving the creator's reference as the only one held. The drm_gem_object_put() then drops that last reference, freeing the object via rocket_gem_bo_free(), and the subsequent goto err makes drm_gem_shmem_object_free() run on the already freed object.Return directly on the error instead: the put has already released everything the function acquired at this point, so there is nothing left to clean up on the err path. Fixes: 658ebeac3351 ("accel/rocket: Add IOCTL for BO creation") Cc: [email protected] Signed-off-by: Wentao Liang <[email protected]> --- drivers/accel/rocket/rocket_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/accel/rocket/rocket_gem.c b/drivers/accel/rocket/rocket_gem.c index 91095d1b3066..521819041475 100644 --- a/drivers/accel/rocket/rocket_gem.c +++ b/drivers/accel/rocket/rocket_gem.c @@ -82,7 +82,7 @@ int rocket_ioctl_create_bo(struct drm_device *dev, void *data, struct drm_file * ret = drm_gem_handle_create(file, gem_obj, &args->handle); drm_gem_object_put(gem_obj); if (ret) - goto err; + return ret;sgt = drm_gem_shmem_get_pages_sgt(shmem_obj);if (IS_ERR(sgt)) {
Reviewed-by: Jeff Hugo <[email protected]>
