From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pz2-f6.google.com (mail-pz2-f6.google.com [74.125.228.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 52F003BBFC7 for ; Sat, 3 Oct 2026 09:35:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.228.6 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791020103; cv=none; b=oaqVoR4bjfQOs5QVllZc0l50k8E8uac48Bfx21EZtZl4KRLSXqPegmlBlXpKrfHQPakKVIozT0GKcCrrQ9PZ4gO7I1S9DFoDJkX9iQmqXcOGJpS1ssTXcmhanefYYP8v7Z39CjRkpSOdQhxDCrkcS0/8VEeDh96YOAENnF33FkY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791020103; c=relaxed/simple; bh=BnGa8NDJZnK2S1ungKI815U/3TD4/ubYnz77jR0hQ8E=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Yg6sgGnRrgE372NL8qLBlZl2FvSZPDp5wyI5QPwnrUGyGeBxTWz0tfGG1pQJ4Z7JAeD2ZkrQmhvxrQPk3z6R9jXGRFexdfBNmLlfTGQDESIG02V9tRvfbqOvDwh6RdzEoD8cLUiAaKX5EbxRJd0G7KgzwrVon3/fGRIcErX0/BA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ecYySlvP; arc=none smtp.client-ip=74.125.228.6 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ecYySlvP" Received: by mail-pz2-f6.google.com with SMTP id 41be03b00d2f7-cc75f2924abso329640a12.1 for ; Sat, 03 Oct 2026 02:35:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791020102; x=1791624902; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=rBI89OF+N0vXnxCESFaz463auJhNn0qQwp4320r4m4Q=; b=ecYySlvPwZbLZ6zSgXq4BwzXgd2VDG0kMBGnyoQ5VnF9e7UtNnnBOqV5jQsFMhBgpv ZMc2JmjeL05jeht+yw8fT4St0PNZYmcxGJ7+1gL1cPlCioBwjVSFClfbHo6/7Zi4dKAd 8/n23m3HfCqKrMRO96eOHPWA/YgvRgZ4ZG2Zl4HlwJnHYX4VXuNPFPPDoJF99JTeUb5T kCoGvuC8fssZ8lOx40RoFNNbHBWgjUxXNyQld1dlaOWQ9m/6jYsrZYcime/ZN52BTd43 862gkDv5zPtUB2Iia6O4hH7XoLQbHd6LpPp8ksis4UO66wIHRmjsLFSiSmrZRFgkm28g dBmw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791020102; x=1791624902; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=rBI89OF+N0vXnxCESFaz463auJhNn0qQwp4320r4m4Q=; b=s8ZSkHWk/Ru44CgFIaAGe8LpO9sPIwcmM5SEqb/wVfD1b2JvFq9guFiFsNGghye4Gi 3m14MRm87tHnrSBZR9bGJKYjXbMc2xAgVvyOlEdxCaGvQZJliMx9x38kGQMtYe9D7ibh Q9XOJZvYbYRfgvL7qqsC1rYFvgC9rbZ8rhKvbNjosukWJOs9suTADsCgBC92MBKE0+fH pdRAvrsxI9XwoRPIrMJE8mGpreJBBHtHzWf+5OboGt2IHoFUBumSpi0lrjOdB5Ay7VvD CgYxggbxFzd51Yar/RsQH4gjArmqJhOZ6CpVvD7vQwAqj24J9yQ0L2YnhD4hKHMM6Zd/ aGhw== X-Forwarded-Encrypted: i=1; AKwUvBwxTntU9upSBLRhriV190YjLSqfNpT/24LcZque/oXvJVuOUBQruu4zjB7zmWlnklhxvamGwc9KBKnLdNI=@vger.kernel.org X-Gm-Message-State: AFuF++m/u0qr9vVaWZutuMfY/8DpIGOhF7srshCcTGy9dAjRtYXfv4kt d8ytwdf+uM6Ci9Nw8y339QwcUJz0szGPEP0kIwhOPfd58aSSURDinWj/ X-Gm-Gg: AYBFou0KhhPLZr4D6/DLBJjRuKSJrnxJRV6MCfZDjTESpsX75pQ9XgRdMaPs/hzWDmJ a9u9FnseGqekom+KifS40jkq6X+SZZiCs5yc0CcKEmygkLXGlJ3SBb1Hhca7XwDHPTwfIz9C1al qY5Ve0+O/V7B6c0m64mNEBA1H4vFy7U+TQ1SDaJw/uCbbYD/tTiVDaOxAK1vJnDktdVLVlaB2PF 0L1sNNKXJeTyqqc7XdEwk7XRq+d8cQBn6T24vVo3aCJX+JlMN4rKBxdnrt8TYmdIK4AjoJJNtxA VualkeRb5Ug6lmVgBLZ9w3A+iIVGNhgKNw2VtNHOtirEWX3gyaLJDFdH8uB/l6vxllb9cjJkyNR jdMHTJF1icalqyId7vjFFYqyRnOMDcFwKG4SPBpZqp9KwinqMq6gx8TQSjirzgHiQAyltZAmPTZ gPrXPIPvd0pb9C/ty6/+Qukh+2l2i5QxYgXAxMOBMzGWvBO0eog4e+a5OzdnHt7ww= X-Received: by 2002:a05:6a00:1d92:b0:881:2a66:405f with SMTP id d2e1a72fcca58-88af6657eadmr5005327b3a.39.1791020101535; Sat, 03 Oct 2026 02:35:01 -0700 (PDT) Received: from localhost ([129.227.235.110]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-88d3b82bafesm46732b3a.13.2026.10.03.02.35.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Oct 2026 02:35:01 -0700 (PDT) From: Evanshenf To: dri-devel@lists.freedesktop.org Cc: Jianmin Lv , Qianhai Wu , Huacai Chen , Mingcong Bai , Xi Ruoyao , Icenowy Zheng , Sui Jingfeng , stable@vger.kernel.org, linux-kernel@vger.kernel.org, Evanshenf Subject: [PATCH 1/2] drm/loongson: Fix double free on BO initialization failure Date: Sat, 3 Oct 2026 09:34:58 +0000 Message-ID: <20261003093415.e64386de1e64-1-archwse@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit If ttm_bo_init_validate() fails, it drops the buffer object's reference and cleans it up through the supplied destroy callback. lsdc_bo_destroy() releases the GEM object and frees the enclosing lsdc_bo, so freeing it again in lsdc_bo_create() causes a double free on a synchronous failure path. Let TTM own the cleanup after initialization has started and return the error directly. Keep the explicit free on drm_gem_object_init() failure, which occurs before ownership is passed to TTM. Tested on LS7A2000 by making drm_vma_offset_add() return -ENOSPC for one selected dumb-buffer creation. The error reached userspace, the destroy callback ran once, and no handle was published or tracked BO retained. Normal buffer creation, zeroing, mapping, readback and release passed. AI assistance was used for the ownership analysis, fix, fault-injection tools, build and test execution. Fixes: f39db26c5428 ("drm: Add kms driver for loongson display controller") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Evanshenf --- drivers/gpu/drm/loongson/lsdc_ttm.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/gpu/drm/loongson/lsdc_ttm.c b/drivers/gpu/drm/loongson/lsdc_ttm.c index d7441d9..88536e2 100644 --- a/drivers/gpu/drm/loongson/lsdc_ttm.c +++ b/drivers/gpu/drm/loongson/lsdc_ttm.c @@ -475,10 +475,8 @@ struct lsdc_bo *lsdc_bo_create(struct drm_device *ddev, ret = ttm_bo_init_validate(bdev, tbo, bo_type, &lbo->placement, 0, false, sg, resv, lsdc_bo_destroy); - if (ret) { - kfree(lbo); + if (ret) return ERR_PTR(ret); - } return lbo; } base-commit: bca45af5998a05f34b13a2ef11e639bac9c62643 -- 2.43.0