linux/drivers/gpu
Junrui Luo 036d28db18 drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
virtio_gpu_vram_create() frees the object with a bare kfree(vram) on
both error paths after drm_gem_private_object_init() has run, and on the
second one after drm_gem_create_mmap_offset() has linked obj->vma_node
into the device's VMA offset manager. The freed object stays in that
interval tree, so a later lookup or insertion walks freed memory, and
the dma_resv and gpuva lock are never destroyed.

Call drm_gem_object_release() before kfree() on both paths.

Fixes: 16845c5d54 ("drm/virtio: implement blob resources: implement vram object")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Link: https://patch.msgid.link/20260915-fixes-v2-4-a0d799e4db66@outlook.com
2026-09-20 20:48:52 +03:00
..
drm drm/virtio: release the GEM object on virtio_gpu_vram_create() errors 2026-09-20 20:48:52 +03:00
host1x Linux 7.2 2026-08-20 10:58:44 +10:00
ipu-v3
nova-core drm for 7.3-rc1 2026-08-21 08:41:00 -07:00
tests drm/tests/gpu_buddy: fix interleaving in buffer clearance test 2026-08-06 18:07:10 +05:30
trace
vga
buddy.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
Kconfig gpu: Fix dependencies in CONFIG_GPU_BUDDY_KUNIT_TEST 2026-07-29 13:06:24 +02:00
Makefile