[PATCH v2 4/4] drm/virtio: release the GEM object on virtio_gpu_vram_create() errors

[Junrui Luo via B4 Relay]

From: Junrui Luo <moonafterr...@outlook.com>

virtio_gpu_vram_create() frees the object with a bare kfree(vram) on
both error paths after drm_gem_private_object_init() has run, and on the
second one after drm_gem_create_mmap_offset() has linked obj->vma_node
into the device's VMA offset manager. The freed object stays in that
interval tree, so a later lookup or insertion walks freed memory, and
the dma_resv and gpuva lock are never destroyed.

Call drm_gem_object_release() before kfree() on both paths.

Fixes: 16845c5d5409 ("drm/virtio: implement blob resources: implement vram 
object")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Junrui Luo <moonafterr...@outlook.com>
---
 drivers/gpu/drm/virtio/virtgpu_vram.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_vram.c 
b/drivers/gpu/drm/virtio/virtgpu_vram.c
index 5b4a3ab81cd5..01241ce4d07c 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vram.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vram.c
@@ -215,16 +215,12 @@ int virtio_gpu_vram_create(struct virtio_gpu_device 
*vgdev,
 
        /* Create fake offset */
        ret = drm_gem_create_mmap_offset(obj);
-       if (ret) {
-               kfree(vram);
-               return ret;
-       }
+       if (ret)
+               goto err_release_obj;
 
        ret = virtio_gpu_resource_id_get(vgdev, &vram->base.hw_res_handle);
-       if (ret) {
-               kfree(vram);
-               return ret;
-       }
+       if (ret)
+               goto err_release_obj;
 
        virtio_gpu_cmd_resource_create_blob(vgdev, &vram->base, params, NULL,
                                            0);
@@ -240,6 +236,11 @@ int virtio_gpu_vram_create(struct virtio_gpu_device *vgdev,
 
        *bo_ptr = &vram->base;
        return 0;
+
+err_release_obj:
+       drm_gem_object_release(obj);
+       kfree(vram);
+       return ret;
 }
 
 void virtio_gpu_vram_map_deferred(struct virtio_gpu_object_vram *vram)

-- 
2.51.2