diff options
| author | Shuicheng Lin <shuicheng.lin@intel.com> | 2026-04-08 17:52:52 +0000 |
|---|---|---|
| committer | Shuicheng Lin <shuicheng.lin@intel.com> | 2026-04-14 08:36:10 -0700 |
| commit | 601c2aa087b6f21014300a3f107a08ee4dde7bdf (patch) | |
| tree | 40c0a7fa451e7bfaf5e57fc4c6b81edcaf69ecc9 /drivers | |
| parent | 96078a1c68bf97f17fd1d08c3f58f5c5cc9ccd65 (diff) | |
drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()
When type is ttm_bo_type_device and aligned_size != size, the function
returns an error without freeing a caller-provided bo, violating the
documented contract that bo is freed on failure.
Add xe_bo_free(bo) before returning the error.
Fixes: 4e03b584143e ("drm/xe/uapi: Reject bo creation of unaligned size")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260408175255.3402838-2-shuicheng.lin@intel.com
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/gpu/drm/xe/xe_bo.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c index daac53168dba..c2f4f9090fb0 100644 --- a/drivers/gpu/drm/xe/xe_bo.c +++ b/drivers/gpu/drm/xe/xe_bo.c @@ -2329,8 +2329,10 @@ struct xe_bo *xe_bo_init_locked(struct xe_device *xe, struct xe_bo *bo, alignment = SZ_4K >> PAGE_SHIFT; } - if (type == ttm_bo_type_device && aligned_size != size) + if (type == ttm_bo_type_device && aligned_size != size) { + xe_bo_free(bo); return ERR_PTR(-EINVAL); + } if (!bo) { bo = xe_bo_alloc(); |