From: Marc-André Lureau <marcandre.lureau@redhat.com>

When virtio_gpu_create_udmabuf() succeeds but virtio_gpu_remap_udmabuf()
fails (mmap returns MAP_FAILED), virtio_gpu_init_udmabuf() returns early
without closing the dmabuf fd. Since res->blob is never set in this
path, later cleanup via virtio_gpu_cleanup_mapping() skips
virtio_gpu_fini_udmabuf() entirely, leaking the file descriptor.

Call virtio_gpu_destroy_udmabuf() before the early return to close
the fd. This function already handles partial state correctly: it
skips the munmap when res->remapped is NULL and closes the fd when
res->dmabuf_fd >= 0.

Fixes: 9b60cdf98723 ("virtio-gpu: Add udmabuf helpers")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/display/virtio-gpu-udmabuf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/display/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabuf.c
index d5ac1cfca0e..5f08c855dde 100644
--- a/hw/display/virtio-gpu-udmabuf.c
+++ b/hw/display/virtio-gpu-udmabuf.c
@@ -143,6 +143,7 @@ void virtio_gpu_init_udmabuf(struct virtio_gpu_simple_resource *res)
         }
         virtio_gpu_remap_udmabuf(res);
         if (!res->remapped) {
+            virtio_gpu_destroy_udmabuf(res);
             return;
         }
         pdata = res->remapped;
-- 
2.55.0

On 7/13/26 15:56, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> When virtio_gpu_create_udmabuf() succeeds but virtio_gpu_remap_udmabuf()
> fails (mmap returns MAP_FAILED), virtio_gpu_init_udmabuf() returns early
> without closing the dmabuf fd. Since res->blob is never set in this
> path, later cleanup via virtio_gpu_cleanup_mapping() skips
> virtio_gpu_fini_udmabuf() entirely, leaking the file descriptor.
> 
> Call virtio_gpu_destroy_udmabuf() before the early return to close
> the fd. This function already handles partial state correctly: it
> skips the munmap when res->remapped is NULL and closes the fd when
> res->dmabuf_fd >= 0.
> 
> Fixes: 9b60cdf98723 ("virtio-gpu: Add udmabuf helpers")
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

This too smells like a qemu-stable material (the issue is minor though).
I'm picking it up, please let me know if I should not.

Thanks,
/mjt

On 2026/07/13 21:56, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> When virtio_gpu_create_udmabuf() succeeds but virtio_gpu_remap_udmabuf()
> fails (mmap returns MAP_FAILED), virtio_gpu_init_udmabuf() returns early
> without closing the dmabuf fd. Since res->blob is never set in this
> path, later cleanup via virtio_gpu_cleanup_mapping() skips
> virtio_gpu_fini_udmabuf() entirely, leaking the file descriptor.
> 
> Call virtio_gpu_destroy_udmabuf() before the early return to close
> the fd. This function already handles partial state correctly: it
> skips the munmap when res->remapped is NULL and closes the fd when
> res->dmabuf_fd >= 0.
> 
> Fixes: 9b60cdf98723 ("virtio-gpu: Add udmabuf helpers")
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>

On 7/13/26 15:56, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> When virtio_gpu_create_udmabuf() succeeds but virtio_gpu_remap_udmabuf()
> fails (mmap returns MAP_FAILED), virtio_gpu_init_udmabuf() returns early
> without closing the dmabuf fd. Since res->blob is never set in this
> path, later cleanup via virtio_gpu_cleanup_mapping() skips
> virtio_gpu_fini_udmabuf() entirely, leaking the file descriptor.
> 
> Call virtio_gpu_destroy_udmabuf() before the early return to close
> the fd. This function already handles partial state correctly: it
> skips the munmap when res->remapped is NULL and closes the fd when
> res->dmabuf_fd >= 0.
> 
> Fixes: 9b60cdf98723 ("virtio-gpu: Add udmabuf helpers")
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>  hw/display/virtio-gpu-udmabuf.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/display/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabuf.c
> index d5ac1cfca0e..5f08c855dde 100644
> --- a/hw/display/virtio-gpu-udmabuf.c
> +++ b/hw/display/virtio-gpu-udmabuf.c
> @@ -143,6 +143,7 @@ void virtio_gpu_init_udmabuf(struct virtio_gpu_simple_resource *res)
>          }
>          virtio_gpu_remap_udmabuf(res);
>          if (!res->remapped) {
> +            virtio_gpu_destroy_udmabuf(res);
>              return;
>          }
>          pdata = res->remapped;

Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>

-- 
Best regards,
Dmitry

On 13/7/26 14:56, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> When virtio_gpu_create_udmabuf() succeeds but virtio_gpu_remap_udmabuf()
> fails (mmap returns MAP_FAILED), virtio_gpu_init_udmabuf() returns early
> without closing the dmabuf fd. Since res->blob is never set in this
> path, later cleanup via virtio_gpu_cleanup_mapping() skips
> virtio_gpu_fini_udmabuf() entirely, leaking the file descriptor.
> 
> Call virtio_gpu_destroy_udmabuf() before the early return to close
> the fd. This function already handles partial state correctly: it
> skips the munmap when res->remapped is NULL and closes the fd when
> res->dmabuf_fd >= 0.
> 
> Fixes: 9b60cdf98723 ("virtio-gpu: Add udmabuf helpers")
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>   hw/display/virtio-gpu-udmabuf.c | 1 +
>   1 file changed, 1 insertion(+)

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>