diff options
| author | Wentao Liang <vulab@iscas.ac.cn> | 2026-06-07 12:03:03 +0300 |
|---|---|---|
| committer | Dmitry Osipenko <dmitry.osipenko@collabora.com> | 2026-06-08 21:40:51 +0300 |
| commit | 3f26bb732cc136ab20176697c92f32c9c84cb125 (patch) | |
| tree | 17de2b41d0ee93b4eb41f806928c6f1c614cb2e2 | |
| parent | c0837b9cf6eabbad8b8cbddaff1a46a6d0a2e29d (diff) | |
| download | linux-3f26bb732cc136ab20176697c92f32c9c84cb125.tar.xz | |
drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()
dma_fence_unwrap_for_each() internally calls dma_fence_unwrap_first()
which does cursor->chain = dma_fence_get(head), taking an extra
reference. On normal loop completion, dma_fence_unwrap_next()
releases this via dma_fence_chain_walk() -> dma_fence_put().
When virtio_gpu_do_fence_wait() fails and the function returns early
from inside the loop, the cursor->chain reference is never released.
This is the only caller in the entire kernel that does an early return
inside dma_fence_unwrap_for_each.
Add dma_fence_put(itr.chain) before the early return.
Cc: stable@vger.kernel.org
Fixes: eba57fb5498f ("drm/virtio: Wait for each dma-fence of in-fence array individually")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Link: https://patch.msgid.link/20260607090303.92423-1-vulab@iscas.ac.cn
| -rw-r--r-- | drivers/gpu/drm/virtio/virtgpu_submit.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/gpu/drm/virtio/virtgpu_submit.c b/drivers/gpu/drm/virtio/virtgpu_submit.c index dae761fa5788..32cb1e4aa425 100644 --- a/drivers/gpu/drm/virtio/virtgpu_submit.c +++ b/drivers/gpu/drm/virtio/virtgpu_submit.c @@ -65,8 +65,10 @@ static int virtio_gpu_dma_fence_wait(struct virtio_gpu_submit *submit, dma_fence_unwrap_for_each(f, &itr, fence) { err = virtio_gpu_do_fence_wait(submit, f); - if (err) + if (err) { + dma_fence_put(itr.chain); return err; + } } return 0; |