Re: [PATCH] drm/tegra: Fix dma-buf reference on import errors

[Mikko Perttunen <mperttunen@nvidia.com>]

On Monday, October 26, 2026 2:58 PM Karl Mehltretter wrote:
> tegra_bo_import() acquires the reference retained by a successfully
> imported object only after all attachment and mapping operations have
> completed. Its detach error path nevertheless calls dma_buf_put().
> 
> drm_gem_prime_fd_to_handle() holds a temporary reference while invoking
> the import callback and drops it after the callback returns. Consequently,
> when mapping fails after a successful attachment, tegra_bo_import() drops
> that borrowed reference and the caller drops it again.
> 
> With only the installed file descriptor and the temporary import
> reference present, these two puts reduce the file reference count to zero.
> This queues the dma-buf file for release while its descriptor remains
> installed, leaving the descriptor without a live reference for later use
> or close. On a Jetson Nano, forcing the mapping to fail after attachment
> produced:
> 
>   VFS: Close: file count is 0 (f_op=dma_buf_fops)
>   imbalanced put on file reference count
> 
> Remove the unmatched dma_buf_put(). Successful imports continue to take
> their own reference before storing bo->dma_buf, and tegra_bo_free_object()
> drops that reference when the imported object is destroyed.

Please edit and compact your LLM commit messages. All of this verbosity 
and description of only tangentially related code just obscures the 
actual issue.

> 
> Fixes: f5b8794e17e4 ("drm/tegra: gem: Don't attach dma-bufs when not needed")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
> Found while auditing Tegra PRIME-import error handling for
> CONFIG_DMABUF_DEBUG testing.
> 
> Tested on a Jetson Nano (p3450-0000) with CONFIG_DMABUF_DEBUG=y and a
> separate change that rejects zero-byte IOMMU mappings to exercise the
> post-attachment error path. Without this patch, the forced failure
> produced the diagnostics quoted above. With this patch, 100 consecutive
> failures returned -EINVAL, preserved the original dma-buf FD and left zero
> dma-buf objects. No file-reference warnings or DMA-API errors occurred.
> 
> Additional regression coverage passed 33 dma-buf heap selftests, with
> three vgem-only tests skipped, and all seven udmabuf selftests using a
> volatile 2 GiB HugeTLB pool.
> 
>  drivers/gpu/drm/tegra/gem.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
> index f76af73..ed35a34 100644
> --- a/drivers/gpu/drm/tegra/gem.c
> +++ b/drivers/gpu/drm/tegra/gem.c
> @@ -502,7 +502,6 @@ detach:
>  		dma_buf_unmap_attachment_unlocked(attach, bo->sgt, DMA_TO_DEVICE);
>  
>  	dma_buf_detach(buf, attach);
> -	dma_buf_put(buf);
>  free:
>  	drm_gem_object_release(&bo->gem);
>  	kfree(bo);
> 
> base-commit: 21a7f44fd0765fcc5194130b28767786eba1d1e7
> -- 
> 2.39.5 (Apple Git-154)
> 
>