[PATCH] drm/nouveau: Fix gem reference leak in validate_init()

[PATCH] drm/nouveau: Fix gem reference leak in validate_init()

[Wentao Liang]

On the ttm_bo_reserve() failure and "vma not found" error paths, the
loop breaks without adding the looked-up object to any validate list,
so the reference taken by drm_gem_object_lookup() is never released;
validate_fini() only walks the spliced lists.  Drop the reference
before breaking out on both paths.

Fixes: 19ca10d82e33bcfe ("drm/nouveau/gem: lookup VMAs for buffers referenced by pushbuf ioctl")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/nouveau/nouveau_gem.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index 20dba02d6175..c2601b559947 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -513,6 +513,7 @@ validate_init(struct nouveau_channel *chan, struct drm_file *file_priv,
 			if (unlikely(ret)) {
 				if (ret != -ERESTARTSYS)
 					NV_PRINTK(err, cli, "fail reserve\n");
+				drm_gem_object_put(gem);
 				break;
 			}
 		}
@@ -522,6 +523,7 @@ validate_init(struct nouveau_channel *chan, struct drm_file *file_priv,
 			struct nouveau_vma *vma = nouveau_vma_find(nvbo, vmm);
 			if (!vma) {
 				NV_PRINTK(err, cli, "vma not found!\n");
+				drm_gem_object_put(gem);
 				ret = -EINVAL;
 				break;
 			}
-- 
2.34.1

Re: [PATCH] drm/nouveau: Fix gem reference leak in validate_init()

[lyude]

Reviewed-by: Lyude Paul <lyude@redhat.com>

Will push to drm-misc-fixes in a bit

On Wed, 2026-09-16 at 18:02 +0000, Wentao Liang wrote:
> On the ttm_bo_reserve() failure and "vma not found" error paths, the
> loop breaks without adding the looked-up object to any validate list,
> so the reference taken by drm_gem_object_lookup() is never released;
> validate_fini() only walks the spliced lists.  Drop the reference
> before breaking out on both paths.
> 
> Fixes: 19ca10d82e33bcfe ("drm/nouveau/gem: lookup VMAs for buffers
> referenced by pushbuf ioctl")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/gpu/drm/nouveau/nouveau_gem.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c
> b/drivers/gpu/drm/nouveau/nouveau_gem.c
> index 20dba02d6175..c2601b559947 100644
> --- a/drivers/gpu/drm/nouveau/nouveau_gem.c
> +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
> @@ -513,6 +513,7 @@ validate_init(struct nouveau_channel *chan,
> struct drm_file *file_priv,
>  			if (unlikely(ret)) {
>  				if (ret != -ERESTARTSYS)
>  					NV_PRINTK(err, cli, "fail
> reserve\n");
> +				drm_gem_object_put(gem);
>  				break;
>  			}
>  		}
> @@ -522,6 +523,7 @@ validate_init(struct nouveau_channel *chan,
> struct drm_file *file_priv,
>  			struct nouveau_vma *vma =
> nouveau_vma_find(nvbo, vmm);
>  			if (!vma) {
>  				NV_PRINTK(err, cli, "vma not
> found!\n");
> +				drm_gem_object_put(gem);
>  				ret = -EINVAL;
>  				break;
>  			}