> 2026年6月26日 22:59，WenTao Liang <[email protected]> 写道：
>
> ttm_base_object_init calls ttm_object_file_ref(tfile) to acquire a tfile
> reference early in the function. On error paths (idr_alloc failure and
> ttm_ref_object_add failure), the function returns without calling
> ttm_object_file_unref to release this reference, causing a tfile
> reference leak.
>
> Add proper cleanup in the error paths to release the tfile reference via
> ttm_object_file_unref.
>
> Cc: [email protected]
> Fixes: 0b8762e997df ("drm/ttm, drm/vmwgfx: Move the lock- and object
> functionality to the vmwgfx driver")
> Signed-off-by: WenTao Liang <[email protected]>
> ---
> drivers/gpu/drm/vmwgfx/ttm_object.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.c
> b/drivers/gpu/drm/vmwgfx/ttm_object.c
> index 2421b0dd057c..93ae5a07d70a 100644
> --- a/drivers/gpu/drm/vmwgfx/ttm_object.c
> +++ b/drivers/gpu/drm/vmwgfx/ttm_object.c
> @@ -204,7 +204,7 @@ int ttm_base_object_init(struct ttm_object_file *tfile,
> spin_unlock(&tdev->object_lock);
> idr_preload_end();
> if (ret < 0)
> - return ret;
> + goto err_unref_tfile;
>
> base->handle = ret;
> ret = ttm_ref_object_add(tfile, base, NULL, false);
> @@ -218,6 +218,10 @@ int ttm_base_object_init(struct ttm_object_file *tfile,
> spin_lock(&tdev->object_lock);
> idr_remove(&tdev->idr, base->handle);
> spin_unlock(&tdev->object_lock);
> + ttm_object_file_unref(&base->tfile);
> + return ret;
> +err_unref_tfile:
> + ttm_object_file_unref(&base->tfile);
> return ret;
> }
>
> --
> 2.39.5 (Apple Git-154)
Please ignore this patch. I will resend a proper version after
learning the kernel submission process.
Apologies for the noise.
Best regards,
WenTao Liang
