> 2026年6月26日 22:47，WenTao Liang <[email protected]> 写道：
>
> nvkm_object_ctor initializes ucgrp with an embedded kref and increments
> the engine's reference count. When nvkm_cgrp_new subsequently fails, the
> function jumps to done without calling nvkm_object_del to release ucgrp.
> The caller ignores *pobject on error, so the ucgrp object and its engine
> reference are permanently leaked.
>
> Cc: [email protected]
> Fixes: 06db7fded6de ("drm/nouveau/fifo: add new channel classes")
> Signed-off-by: WenTao Liang <[email protected]>
> ---
> drivers/gpu/drm/nouveau/nvkm/engine/fifo/ucgrp.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ucgrp.c
> b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ucgrp.c
> index dfa3c7dbdf34..7d11b92f946b 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ucgrp.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ucgrp.c
> @@ -113,8 +113,10 @@ nvkm_ucgrp_new(struct nvkm_fifo *fifo, const struct
> nvkm_oclass *oclass, void *a
> *pobject = &ucgrp->object;
>
> ret = nvkm_cgrp_new(runl, args->v0.name, vmm, true, &ucgrp->cgrp);
> - if (ret)
> + if (ret) {
> + nvkm_object_del(pobject);
> goto done;
> + }
>
> /* Return channel group info to caller. */
> args->v0.cgid = ucgrp->cgrp->id;
> --
> 2.39.5 (Apple Git-154)
Please ignore this patch. I will resend a proper version after
learning the kernel submission process.
Apologies for the noise.
Best regards,
WenTao Liang
