amdgpu_ualink_export_handle() takes an explicit amdgpu_bo_ref() before
building the exporter node, and the out: label only drops the reference
from drm_gem_object_lookup(). The xarray insert failure path unrefs the
BO, but the drm_gem_prime_handle_to_dmabuf() failure path does not.
Userspace can hit that path at will, for example by exhausting its file
descriptor table so the dmabuf export returns -EMFILE, leaking a BO
reference and its pinned VRAM on every attempt.
Fixes: 6b1a5ad90778 ("drm/amdgpu: Implement UALink handle export")
Reported-by: Sashiko-bot <[email protected]>
Signed-off-by: Mukul Joshi <[email protected]>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
index 3d84f5a7a34d..a7ae9ffde1b5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
@@ -4023,6 +4023,7 @@ int amdgpu_ualink_export_handle(struct drm_device *dev,
struct drm_file *filp,
if (IS_ERR(exp_xa_node->dmabuf)) {
r = PTR_ERR(exp_xa_node->dmabuf);
dev_err(adev->dev, "Failed to generate DMABuf for the
BO\n");
+ amdgpu_bo_unref(&robj);
kfree(exp_xa_node);
goto out;
}
--
2.55.0
