Applied. Thanks!
On Fri, Oct 2, 2026 at 8:52 AM Haojie Li <[email protected]> wrote: > > When kzalloc fails for metadata_buffer in > amdgpu_amdkfd_get_dmabuf_info(), the function returns -ENOMEM directly > without calling dma_buf_put(), leaking the dma_buf reference obtained > earlier via dma_buf_get(). > > Fix both issues by: > - Adding an error check after the first amdgpu_bo_get_metadata() call > - Replacing the direct return with r = -ENOMEM and goto out_put to > ensure dma_buf_put() is called on all error paths > > Fixes: f54ce9e8cbd3 ("drm/amdkfd: Let driver decide buffer size at > AMDKFD_IOC_GET_DMABUF_INFO ioctl") > Signed-off-by: Haojie Li <[email protected]> > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c > index 054870e9078d..ca5860e493a6 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c > @@ -598,14 +598,18 @@ int amdgpu_amdkfd_get_dmabuf_info(struct amdgpu_device > *adev, int dma_buf_fd, > /* first get metadata_size by buffer = NULL */ > r = amdgpu_bo_get_metadata(bo, NULL, 0, > metadata_size, NULL); > + if (r) > + goto out_put; > > /* user buf_size is bigger than bo metadata_size > * allocate a buf at kernel space and copy */ > if (*metadata_size <= buffer_size) { > *metadata_buffer = kzalloc(*metadata_size, > GFP_KERNEL); > > - if (!*metadata_buffer) > - return -ENOMEM; > + if (!*metadata_buffer) { > + r = -ENOMEM; > + goto out_put; > + } > > r = amdgpu_bo_get_metadata(bo, *metadata_buffer, > *metadata_size, > NULL, &metadata_flags); > -- > 2.25.1 >
