From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C11853D9695 for ; Wed, 29 Jul 2026 21:19:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785359985; cv=none; b=E02uFdxgYJGORG/gI0Xj9td8Otm1oxev+B68w8aGsZdVySv09vNszDlfsd0TSw4ANpqH41xWD6pp+4W11tcE+FDdm+gvyUyERxL40i3wO/317F5ecSUgKZW4TIIfJSM4MrpBFMB6fdaws0sFuWMD2dWnS/CK/Uuq5q+v2qljJZ4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785359985; c=relaxed/simple; bh=/MAiXAbQNLukFOvamzXuv5lJjwdh98FXvF7dya3cf8I=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=Cks3hLvuDc4qWrJSSIayRQvXNwdGWDet1ZXnw4bc9HfCJ3pXoRu6dwf3sTw06gQZLhkzcOjPpaOP8Bahdca6aMxo/RAgClqcbmAK8E4wthQytifOqTjPf/IJsEOVEJlkoepPOFgSPYryH6Q/XHIKtziCo5WNXs0OktW+IahuXFg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=kJq8jUPO; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=bTmRPFpU; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="kJq8jUPO"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="bTmRPFpU" Received: from pps.filterd (m0279872.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66TL706j2882515 for ; Wed, 29 Jul 2026 21:19:43 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= Wkr/IHbH/vmkP6F8QZmjiDF071+OEQwubDm18Vb8qFo=; b=kJq8jUPOh41Wutg/ mB0hRRG0yHeTfgaI96Erp4IhZ1LWAuN8TST2hVvko/nMfHQqx5FAQymf2+j4AY+Q 1yVfSmdL8iyPrNTWxhx2qEpY1Wp4VsQ/YmA9HdjhxC5PVWm4pWlwXy7h4Rw9E5J5 dxJ4CCGG9Czj/nfkclzs4TbqsMT3Nhhs7I5upnkaODA24t5un3i/Nsn5P1JxutGq IKa7jjVHg4Z53GcbTil9ot2xFBQQg4jShvc2XEu5vfl0gK82obsUVsYt4+wZ7ZgR 7CM4t4ljQLlIUzO6tl0KJ+6D4VAyLD+BJX6hwKJA/7mzV3/dUPRfT3Uv1Wg1COLJ 41J7EQ== Received: from mail-pf1-f199.google.com (mail-pf1-f199.google.com [209.85.210.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fqs4t819d-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Wed, 29 Jul 2026 21:19:42 +0000 (GMT) Received: by mail-pf1-f199.google.com with SMTP id d2e1a72fcca58-84e04598adeso1149348b3a.2 for ; Wed, 29 Jul 2026 14:19:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1785359981; x=1785964781; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Wkr/IHbH/vmkP6F8QZmjiDF071+OEQwubDm18Vb8qFo=; b=bTmRPFpUVt3hrwmWJ6i6hBDpx2Vemx0Njs8bIlJ+6ZRpYifTNoFBV/dsA7RFqtoQdU 4WdsDWT7z9dBVOHdEZup8AG5c7MNeBYy8bVXQPQeXf5Ni6YqAHLqz5jcfGDRbyWkcTZ/ gLMJiUvlMAdDSbYseKHqj4L8sAQaaE6JfEHwoXS9fwk5W5SV7k+0AX+ggwrSz8IpPBpw yF0wizpGLVoXr6LrzRwedKnzFhUJXssgr0Ltlvsmz23pg5Yj9dOXEpiRtrbxmdU43rJ2 59kJWNknIKhiy/fSxBEjdO3x5a9M9rFsxVPTlp4T4U7ktEhE0ABaZ4mUD+WshvPmI7kt 8qWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785359981; x=1785964781; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Wkr/IHbH/vmkP6F8QZmjiDF071+OEQwubDm18Vb8qFo=; b=ApinY/JeWPYEqBEf8rqcWSShWi3E4X89RXwE1oNrCNR5o7URCfdF3cm5aUXlOwpS3X V/P9Ga5g65fqf1ioxJ1UeeDTZ9TheXPBHGBXSyzBviU3iIwvaBqvXIkQHxJ3hS7VBRpx Y+sgaKbkxgipB243mgyL3ijKR+fWR1sUX0gn1N4hZJh1qptmpGhCgHidHyWxzMP0xb1T Imv7dpEp5nu26iC2mojOc5YXN7sZ3TvdMu+8i9nIa0IU5GvFyZIIwA4afY4hSmyqmRH7 DTpJbItgzu2HPO+PlrtmVDaTlxTfuFLSv6Vbgqr0+49tKrNZkoGcmuDyuZnMX+1PpWnW vUIw== X-Forwarded-Encrypted: i=1; AHgh+Rq1uRPtuRLbWmyTKsr+migtQvUOaWBn2xg6zfc33z9C7unabeycNq7mchR88w8BgdzReOFt55MEerTXy7k=@vger.kernel.org X-Gm-Message-State: AOJu0Yyjd0iEg0ER2yyAErbIu+okY012BZuCKN7zKAGyCXuyOHj9o2fv p7xko4fm9t005NCqlp5RrdmsR5HBvMEB07W6CZ0jylkaR9V6ie07q45Ly1fyfB6I7ZIOPE3gG4B YvkkAsrS5ATRnCy2CKT9KqKAmo4KBnC1BTvfMFWN28anRQ+agg2DiZtPCkHBhJDVMevE= X-Gm-Gg: AR+sD12UYFtFFHr1MvNogJwEHMaAtr1x829vNQZBSxFj49GPZ76mngrG4Y4fQHhBk1Z XnPw2ZIWQu34CMdtgjUyJ2p8b2A8vGMF9bdPP4dcSYTO7fG2+QBb56P5sgOJrDl3OqK/IaF+tPK ZgJObJi5jOW0O+58UuBOx27+AQGDiVVOkVedKThwH8aQWpOPZts/2V790Wlkxi+T2igNFFymEaw fBauIm5vHJ+DZ2iTe9/Bc1GAiJQZXeYzFGPaoxFDbiMEWh9Mch6NBlTgPrho8QTb/hkcqlTfebk 4YlIlj1FqOzxnw4i5tE9FPDDA+jzw8z95EqOPrhYneAwj0W+c+5zO/ErisnnvwAqL23qdCN33ht OfG3TNyUHSsTYPahW+zbEpv811tDmoi5xOH2oaLBi82F7ehWWfACUWw== X-Received: by 2002:a05:6300:2288:b0:3c0:9c19:b275 with SMTP id adf61e73a8af0-3c8ba6550f3mr9253696637.67.1785359981402; Wed, 29 Jul 2026 14:19:41 -0700 (PDT) X-Received: by 2002:a05:6300:2288:b0:3c0:9c19:b275 with SMTP id adf61e73a8af0-3c8ba6550f3mr9253685637.67.1785359980956; Wed, 29 Jul 2026 14:19:40 -0700 (PDT) Received: from [10.226.59.182] (i-global254.qualcomm.com. [199.106.103.254]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31504927a7bsm14864812eec.0.2026.07.29.14.19.39 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 29 Jul 2026 14:19:40 -0700 (PDT) Message-ID: <19305f3f-7567-48d3-a0b2-6597fdc3c314@oss.qualcomm.com> Date: Wed, 29 Jul 2026 15:19:38 -0600 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2] accel/qaic: fix GEM object refcount leak in qaic_attach_slice_bo_ioctl To: WenTao Liang , dri-devel@lists.freedesktop.org Cc: linux-arm-msm@vger.kernel.org, carl.vanderlip@oss.qualcomm.com, ogabbay@kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Greg KH References: <20260628115119.44215-1-vulab@iscas.ac.cn> Content-Language: en-US From: Jeff Hugo In-Reply-To: <20260628115119.44215-1-vulab@iscas.ac.cn> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Proofpoint-GUID: orvxpJYsigNMi4R2_N_bGPgBPy8Lybyg X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI5MDE2MCBTYWx0ZWRfX7tpgNqyMEmmY GjUDheMN1Mg1oSQ3lN19K30QO1xnDxGuX90OEy3UjivYcTqcIGkRjh9NQgPTOjkV78N6b/c2dnh e/yWC41jFhqybjSY/P/MXVqjVR4xytE= X-Proofpoint-ORIG-GUID: orvxpJYsigNMi4R2_N_bGPgBPy8Lybyg X-Authority-Analysis: v=2.4 cv=WZQ8rUhX c=1 sm=1 tr=0 ts=6a6a6e6e cx=c_pps a=WW5sKcV1LcKqjgzy2JUPuA==:117 a=JYp8KDb2vCoCEuGobkYCKw==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yx91gb_oNiZeI1HMLzn7:22 a=ag1SF4gXAAAA:8 a=VwQbUJbxAAAA:8 a=mPBHZ_2hYfeim0CFHOkA:9 a=QEXdDO2ut3YA:10 a=OpyuDcXvxspvyRM73sMx:22 a=Yupwre4RP9_Eg_Bd0iYG:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI5MDE2MCBTYWx0ZWRfXzEg9L5YI5m3M E9vuD5vcOyyg1uQrG1sGqU5s3uRfBn0owvSvCwjzIrnUpNcLbfP/IMDP7HSu/BJCPIDtWoLXe2/ MwHNOGFf+YG1zcK3UaMeQRvQN9hveUaba1VN3RzDBalwguETu9koxEmvadpy7T6Pf8IlUnQQYoj 5bwss9RoKnajYtVzJBxvXdMeliUBIQ/x34Q/Qlz9BZ4r/P1wH5NUz8g6WrGCXkP/hgLutVAHnqf hsnUp+KxCWCmR7R49Mcz/nntryjRYhdQj1fWjajOnTAfAvVxC0pZHb58jc+AOj0v4PWnVz13XXd pr25tvPljI+5w8rNoMlnPvCRoudJHa+/FS9xd1K9NdkdKDx8ot5i2W2dTtZO/qltkG8D8rCZjsV XQ+CLQX4QCAekyNJNcnHrSCI5Jmy3v1MTt7gOYZkJXnJLTNx+Pq7+rigyy64IFB26W/Q8WwTaO/ 2jxztAU8/SF7XZqiCEQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-29_08,2026-07-29_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 adultscore=0 spamscore=0 suspectscore=0 lowpriorityscore=0 clxscore=1015 phishscore=0 bulkscore=0 priorityscore=1501 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607290160 On 6/28/2026 5:51 AM, WenTao Liang wrote: > drm_gem_object_lookup() acquires a GEM object reference on success. All > error paths correctly release it via put_bo, but the success path returns > without calling drm_gem_object_put(obj). Since list_add_tail does not > transfer ownership, the GEM object reference is permanently leaked on > each successful call. NACK. put() is specifically not called in the success case as data structures which depend on the BO are not released until detach_slice_bo(), which happens to be where the corresponding put() is. It is also not possible to successfully call attach_slice() more than once without a corresponding detach_slice_bo(). The get() and put() operations for the concerned paths are currently balanced, but this patch will actually introduce an unbalanced state (extra put() operations). As far as the impact of not having this patch per the commit text (memory leak) I'm aware of many memory stress tests, yet I recall no reports of memory leaks from attach_slice(). You will need to provide proof, from actual testing, that this is an issue. > Suggested-by: Greg KH This tag seems wrong, as there was nothing I can find on V1 in Lore which indicates this tag is appropriate. > Fixes: 75af0a585af9 ("accel/qaic: Grab ch_lock during QAIC_ATTACH_SLICE_BO") > Cc: stable@vger.kernel.org > Signed-off-by: WenTao Liang > --- > Changes in v2: > - Fix patch format based on reviewer feedback > --- > drivers/accel/qaic/qaic_data.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c > index 1e4c579d2725..b17df7bf565d 100644 > --- a/drivers/accel/qaic/qaic_data.c > +++ b/drivers/accel/qaic/qaic_data.c > @@ -1084,6 +1084,7 @@ int qaic_attach_slice_bo_ioctl(struct drm_device *dev, void *data, struct drm_fi > > bo->sliced = true; > list_add_tail(&bo->bo_list, &bo->dbc->bo_lists); > + drm_gem_object_put(obj); > srcu_read_unlock(&dbc->ch_lock, rcu_id); > mutex_unlock(&bo->lock); > kfree(slice_ent);