vmw_gem_object_create_with_handle() leaves the allocation reference with
its caller, including when drm_gem_handle_create() fails. The allocation
ioctl currently skips dropping that reference on this error path, leaking
the buffer object and its backing storage.
Drop the allocation reference at the common exit when an object was
allocated. Keep the helper ownership rules unchanged, as its other callers
already release the returned object on failure.
Fixes: 9ef8d83e8e25 ("drm/vmwgfx: Do not drop the reference to the handle too
soon")
Cc: [email protected]
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <[email protected]>
---
drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
index 39f8c46550c2..fd5b84744f88 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
@@ -233,9 +233,10 @@ int vmw_gem_object_create_ioctl(struct drm_device *dev,
void *data,
rep->map_handle = drm_vma_node_offset_addr(&vbo->tbo.base.vma_node);
rep->cur_gmr_id = handle;
rep->cur_gmr_offset = 0;
- /* drop reference from allocate - handle holds it now */
- drm_gem_object_put(&vbo->tbo.base);
out_no_bo:
+ /* Drop the allocation reference even if handle creation failed. */
+ if (vbo)
+ drm_gem_object_put(&vbo->tbo.base);
return ret;
}
--
2.34.1
