From nobody Sat Jul 25 19:30:20 2026 Received: from mail-qv1-f41.google.com (mail-qv1-f41.google.com [209.85.219.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BFF8F3128D4 for ; Tue, 14 Jul 2026 13:21:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784035298; cv=none; b=En/+D+NA8Wnzqmlj3tJG3cnlY+HQOWyBEMaCUzxDZkoyWiojkuGpal11DkU1I/4wPn5wYi8GnEibyb2zZnAnw90XLYCz3EHhp4uhZr7/xOowhBAI9cp5pqR1AuiHHbC/Q+1F7XpSXrQ/R+3Bx1EvGzWoLCKFq67eETBQAC2sM8Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784035298; c=relaxed/simple; bh=N3Wt39r+betV+ag1LhGjcHS/hzSO1IAUGjKuO+ynb34=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=FkN0BwP+23TxwtgEaHPpuPbcnioAFMR4H6mAfpYZ9t6T9r/Tm90jmXYXk+W+krHUZO48A2PTp8+YO+YhGyO2IFHu5vFKhR5/032ESa4tibHAyfbTpqOU6UK+xv4uqrl7WtlUq+0RYdiJIZlzOTJFBQGpPu1xsQt+ePv4BY9Khw0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bm6nld/2; arc=none smtp.client-ip=209.85.219.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bm6nld/2" Received: by mail-qv1-f41.google.com with SMTP id 6a1803df08f44-8e5be46f663so7538286d6.0 for ; Tue, 14 Jul 2026 06:21:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784035295; x=1784640095; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Ljyj9DkB5xbAZqgYsTFaAqTNeOS834qmzh1t0MU7eq0=; b=bm6nld/26gyRfH7vYrhfZr4gOS4/rRdkFVdISMk0wQ9VjgkjTjDGOCoQ/IstKcraLe 9DsgvpSbaHRxS5uYR1zgyXTcUrVcXdp9U86i/nVHy4U0sGH0xqQr7cynCaxumpbElF5v iQIQzDHlLvh1+R5cIatpXsll+yFbA83GZBdov+nqOx4xe8vMIzAXFA1bYTeYblTKGYl6 YqJyEDheXsf0FzE8luwyR/DWOoxo/K3vhTqZaIhtgNXSOBrKPoMAKqgC8YB8/Q622bEW nIEmXnR725VtJUQWzER+c8vtuKjJMfcIrdDO8J9ZI7I+xJNowCKx3R//n+eQDMW25qFv mgFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784035295; x=1784640095; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Ljyj9DkB5xbAZqgYsTFaAqTNeOS834qmzh1t0MU7eq0=; b=WhnNi2ZEHVvYcq1wA+UxtU4K8mFLn6Qgyly9/E7i9iijMKCS5jeakTj/oNAiM/rr1C zDwfCSyscyPXJ5VxlfPnSxQnbMYu7g9WHL01V/Zo0RKX3ZiS78OpIRiRyqsqhlkblLlV Cao9HkKj/zw2ubLbRGTAwHO4gdi46ndYGtfp0OrJm+v60xlWydbVh2qUAEbM/HZsGoc+ +alhIZfG9YqvwDS8LAD7jpsVH/1ogwgS8F7skplZVoeBGIFMENSxRbJLzLePBLWeMDgX TY/mNy6HhQpk889o3rWhQpAB2nrFHQaQx6YuToV3MiIpM9l+pVlPVBRb2jGGmze0Z3ut ILiw== X-Forwarded-Encrypted: i=1; AHgh+RoOSngL9OifhOyPBnHREZL6DA4ojIEwwwz1CMGtZW3iwNjER9Ew1lAVPSmlguk3s3Px16tquyrILdgymEc=@vger.kernel.org X-Gm-Message-State: AOJu0Yy8cWkaNXJlj3tBpTy0ttn04jBzibHjfcJiz4EdxZIpLxWOh872 l3s1BVD0ZJT7RidSa8YHsF8U6q9XJBmO4g40huBJXgYoAjvB420uu5hCsV+Nlk9JwdgOKQ== X-Gm-Gg: AfdE7ckoMiZ7u1V5RBaKS2+TipeteM3JP2i+7dSHb3aNr3PV9eNq0dIoWDWAXOUWwDn dByS3bzL4ShKAtRDFDVVrS9fSEzNea16kZjptBNDYOPH77klyr/7oOmniaMa7ndpUx6wzsnqN7c FZdafue1xDb6LG6Ng8OA45MrtxfYdcf7A2FSzIrxMpgIkxwB2/yOXK8P3X1Iaf8X/sjMEQhoF/x Rlocs1WJmp2873pqaL+0rlOTE98Z6JBi3PMEGSCx2Req2BwpNXWrghTl9H+FWbtBM1EwHOMrwA+ zlgm3JXqk3j7wzgRoXgRsaMHZX3kvWjARuCGRCFu9rllBEcPot7zlX8/Xel4MPKb836KUQjMZQE 2/Lv1vD4/sw0BRmpXscRqWwE1wkNSfD9aWsk7I34UrnnRssSkvYGvbB4ZE/mdG+i9BwUHM1U= X-Received: by 2002:a05:6214:27c3:b0:8fd:6de3:dd8b with SMTP id 6a1803df08f44-90402b67f93mr150157116d6.65.1784035295372; Tue, 14 Jul 2026 06:21:35 -0700 (PDT) Received: from lgs.. ([2001:250:5800:1000::f280]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-9063df4319asm66297986d6.38.2026.07.14.06.21.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 06:21:34 -0700 (PDT) From: Guangshuo Li To: Thierry Reding , Mikko Perttunen , David Airlie , Simona Vetter , Jonathan Hunter , dri-devel@lists.freedesktop.org, linux-tegra@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li Subject: [PATCH] drm/tegra: Finalize GEM object on initialization failure Date: Tue, 14 Jul 2026 21:19:22 +0800 Message-ID: <20260714131923.1575860-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" tegra_bo_alloc_object() allocates bo and passes its embedded GEM object to drm_gem_object_init(). drm_gem_object_init() initializes the GEM private state before creating the shmem backing file. If the file creation fails, it returns an error with the reservation object and GPUVA mutex still initialized. The current error path directly frees bo, bypassing the matching GEM private-object cleanup. Finalize the partially initialized GEM object with drm_gem_private_object_fini() before freeing bo. This issue was found by a static analysis tool I am developing. Fixes: c28d4a317fef ("drm/tegra: gem: Extract tegra_bo_alloc_object()") Signed-off-by: Guangshuo Li Reviewed-by: Mikko Perttunen --- drivers/gpu/drm/tegra/gem.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c index 436394e04812..eb513cb7521c 100644 --- a/drivers/gpu/drm/tegra/gem.c +++ b/drivers/gpu/drm/tegra/gem.c @@ -314,8 +314,10 @@ static struct tegra_bo *tegra_bo_alloc_object(struct d= rm_device *drm, size =3D round_up(size, PAGE_SIZE); =20 err =3D drm_gem_object_init(drm, &bo->gem, size); - if (err < 0) + if (err < 0) { + drm_gem_private_object_fini(&bo->gem); goto free; + } =20 err =3D drm_gem_create_mmap_offset(&bo->gem); if (err < 0) --=20 2.43.0