RE: [PATCH] drm/amdgpu: Fix GEM object leak in amdgpu_gem_op_ioctl()

[Deucher, Alexander]

Public

> -----Original Message-----
> From: Wentao Liang <vulab@xxxxxxxxxxx>
> Sent: Wednesday, September 16, 2026 5:53 AM
> To: Francis, David <David.Francis@xxxxxxx>
> Cc: airlied@xxxxxxxxx; Deucher, Alexander <Alexander.Deucher@xxxxxxx>;
> amd-gfx@xxxxxxxxxxxxxxxxxxxxx; Koenig, Christian
> <Christian.Koenig@xxxxxxx>; dri-devel@xxxxxxxxxxxxxxxxxxxxx; linux-
> kernel@xxxxxxxxxxxxxxx; simona@xxxxxxxx; Wentao Liang <vulab@xxxxxxxxxxx>;
> stable@xxxxxxxxxxxxxxx
> Subject: [PATCH] drm/amdgpu: Fix GEM object leak in
> amdgpu_gem_op_ioctl()
>
> In the AMDGPU_GEM_OP_GET_MAPPING_INFO case,
> amdgpu_gem_op_ioctl() takes a reference to the GEM object with
> drm_gem_object_lookup() and holds the buffer object locked through
> drm_exec.  When the allocation of the mapping array fails, the function
> returns -ENOMEM directly, leaving the exec locks held and leaking the GEM
> object reference returned by drm_gem_object_lookup().
>
> Jump to the out_exec label instead so that drm_exec_fini() and
> drm_gem_object_put() release the locks and the GEM object reference.
>
> Fixes: 4d82724f7f2b ("drm/amdgpu: Add mapping info option for GEM_OP
> ioctl")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>


This was already fixed.

Thanks,

Alex

> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
> index 123d4a09114d..06dd2e8a5b47 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
> @@ -1094,8 +1094,10 @@ int amdgpu_gem_op_ioctl(struct drm_device
> *dev, void *data,
>                * be retried.
>                */
>               vm_entries = kvcalloc(args->num_entries,
> sizeof(*vm_entries), GFP_KERNEL);
> -             if (!vm_entries)
> -                     return -ENOMEM;
> +             if (!vm_entries) {
> +                     r = -ENOMEM;
> +                     goto out_exec;
> +             }
>
>               amdgpu_vm_bo_va_for_each_valid_mapping(bo_va,
> mapping) {
>                       if (num_mappings < args->num_entries) {
> --
> 2.34.1