[PATCH] drm/tegra: Fix dma-buf reference on import errors

[PATCH] drm/tegra: Fix dma-buf reference on import errors

[Karl Mehltretter]

tegra_bo_import() acquires the reference retained by a successfully
imported object only after all attachment and mapping operations have
completed. Its detach error path nevertheless calls dma_buf_put().

drm_gem_prime_fd_to_handle() holds a temporary reference while invoking
the import callback and drops it after the callback returns. Consequently,
when mapping fails after a successful attachment, tegra_bo_import() drops
that borrowed reference and the caller drops it again.

With only the installed file descriptor and the temporary import
reference present, these two puts reduce the file reference count to zero.
This queues the dma-buf file for release while its descriptor remains
installed, leaving the descriptor without a live reference for later use
or close. On a Jetson Nano, forcing the mapping to fail after attachment
produced:

  VFS: Close: file count is 0 (f_op=dma_buf_fops)
  imbalanced put on file reference count

Remove the unmatched dma_buf_put(). Successful imports continue to take
their own reference before storing bo->dma_buf, and tegra_bo_free_object()
drops that reference when the imported object is destroyed.

Fixes: f5b8794e17e4 ("drm/tegra: gem: Don't attach dma-bufs when not needed")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Found while auditing Tegra PRIME-import error handling for
CONFIG_DMABUF_DEBUG testing.

Tested on a Jetson Nano (p3450-0000) with CONFIG_DMABUF_DEBUG=y and a
separate change that rejects zero-byte IOMMU mappings to exercise the
post-attachment error path. Without this patch, the forced failure
produced the diagnostics quoted above. With this patch, 100 consecutive
failures returned -EINVAL, preserved the original dma-buf FD and left zero
dma-buf objects. No file-reference warnings or DMA-API errors occurred.

Additional regression coverage passed 33 dma-buf heap selftests, with
three vgem-only tests skipped, and all seven udmabuf selftests using a
volatile 2 GiB HugeTLB pool.

 drivers/gpu/drm/tegra/gem.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
index f76af73..ed35a34 100644
--- a/drivers/gpu/drm/tegra/gem.c
+++ b/drivers/gpu/drm/tegra/gem.c
@@ -502,7 +502,6 @@ detach:
 		dma_buf_unmap_attachment_unlocked(attach, bo->sgt, DMA_TO_DEVICE);
 
 	dma_buf_detach(buf, attach);
-	dma_buf_put(buf);
 free:
 	drm_gem_object_release(&bo->gem);
 	kfree(bo);

base-commit: 21a7f44fd0765fcc5194130b28767786eba1d1e7
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] drm/tegra: Fix dma-buf reference on import errors

[Mikko Perttunen]

On Monday, October 26, 2026 2:58 PM Karl Mehltretter wrote:
> tegra_bo_import() acquires the reference retained by a successfully
> imported object only after all attachment and mapping operations have
> completed. Its detach error path nevertheless calls dma_buf_put().
> 
> drm_gem_prime_fd_to_handle() holds a temporary reference while invoking
> the import callback and drops it after the callback returns. Consequently,
> when mapping fails after a successful attachment, tegra_bo_import() drops
> that borrowed reference and the caller drops it again.
> 
> With only the installed file descriptor and the temporary import
> reference present, these two puts reduce the file reference count to zero.
> This queues the dma-buf file for release while its descriptor remains
> installed, leaving the descriptor without a live reference for later use
> or close. On a Jetson Nano, forcing the mapping to fail after attachment
> produced:
> 
>   VFS: Close: file count is 0 (f_op=dma_buf_fops)
>   imbalanced put on file reference count
> 
> Remove the unmatched dma_buf_put(). Successful imports continue to take
> their own reference before storing bo->dma_buf, and tegra_bo_free_object()
> drops that reference when the imported object is destroyed.

Please edit and compact your LLM commit messages. All of this verbosity 
and description of only tangentially related code just obscures the 
actual issue.

> 
> Fixes: f5b8794e17e4 ("drm/tegra: gem: Don't attach dma-bufs when not needed")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
> Found while auditing Tegra PRIME-import error handling for
> CONFIG_DMABUF_DEBUG testing.
> 
> Tested on a Jetson Nano (p3450-0000) with CONFIG_DMABUF_DEBUG=y and a
> separate change that rejects zero-byte IOMMU mappings to exercise the
> post-attachment error path. Without this patch, the forced failure
> produced the diagnostics quoted above. With this patch, 100 consecutive
> failures returned -EINVAL, preserved the original dma-buf FD and left zero
> dma-buf objects. No file-reference warnings or DMA-API errors occurred.
> 
> Additional regression coverage passed 33 dma-buf heap selftests, with
> three vgem-only tests skipped, and all seven udmabuf selftests using a
> volatile 2 GiB HugeTLB pool.
> 
>  drivers/gpu/drm/tegra/gem.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
> index f76af73..ed35a34 100644
> --- a/drivers/gpu/drm/tegra/gem.c
> +++ b/drivers/gpu/drm/tegra/gem.c
> @@ -502,7 +502,6 @@ detach:
>  		dma_buf_unmap_attachment_unlocked(attach, bo->sgt, DMA_TO_DEVICE);
>  
>  	dma_buf_detach(buf, attach);
> -	dma_buf_put(buf);
>  free:
>  	drm_gem_object_release(&bo->gem);
>  	kfree(bo);
> 
> base-commit: 21a7f44fd0765fcc5194130b28767786eba1d1e7
> -- 
> 2.39.5 (Apple Git-154)
> 
>