On Sat, Oct 3, 2026 at 5:35 PM Evanshenf <[email protected]> wrote: > > If ttm_bo_init_validate() fails, it drops the buffer object's reference > and cleans it up through the supplied destroy callback. lsdc_bo_destroy() > releases the GEM object and frees the enclosing lsdc_bo, so freeing it > again in lsdc_bo_create() causes a double free on a synchronous failure > path. > > Let TTM own the cleanup after initialization has started and return the > error directly. Keep the explicit free on drm_gem_object_init() failure, > which occurs before ownership is passed to TTM. > > Tested on LS7A2000 by making drm_vma_offset_add() return -ENOSPC for one > selected dumb-buffer creation. The error reached userspace, the destroy > callback ran once, and no handle was published or tracked BO retained. > Normal buffer creation, zeroing, mapping, readback and release passed. > > AI assistance was used for the ownership analysis, fix, fault-injection > tools, build and test execution. > > Fixes: f39db26c5428 ("drm: Add kms driver for loongson display controller") > Cc: [email protected] > Assisted-by: LLM Reviewed-by: Huacai Chen <[email protected]>
> Signed-off-by: Evanshenf <[email protected]> > --- > drivers/gpu/drm/loongson/lsdc_ttm.c | 4 +--- > 1 file changed, 1 insertion(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/loongson/lsdc_ttm.c > b/drivers/gpu/drm/loongson/lsdc_ttm.c > index d7441d9..88536e2 100644 > --- a/drivers/gpu/drm/loongson/lsdc_ttm.c > +++ b/drivers/gpu/drm/loongson/lsdc_ttm.c > @@ -475,10 +475,8 @@ struct lsdc_bo *lsdc_bo_create(struct drm_device *ddev, > > ret = ttm_bo_init_validate(bdev, tbo, bo_type, &lbo->placement, 0, > false, sg, resv, lsdc_bo_destroy); > - if (ret) { > - kfree(lbo); > + if (ret) > return ERR_PTR(ret); > - } > > return lbo; > } > > base-commit: bca45af5998a05f34b13a2ef11e639bac9c62643 > -- > 2.43.0 >
