On 2026-09-22 10:56, Mukul Joshi wrote:
amdgpu_ualink_export_handle() takes an explicit amdgpu_bo_ref() before
building the exporter node, and the out: label only drops the reference
from drm_gem_object_lookup(). The xarray insert failure path unrefs the
BO, but the drm_gem_prime_handle_to_dmabuf() failure path does not.
Userspace can hit that path at will, for example by exhausting its file
descriptor table so the dmabuf export returns -EMFILE, leaking a BO
reference and its pinned VRAM on every attempt.
Fixes: 6b1a5ad90778 ("drm/amdgpu: Implement UALink handle export")
Reported-by: Sashiko-bot<[email protected]>
Signed-off-by: Mukul Joshi<[email protected]>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
index 3d84f5a7a34d..a7ae9ffde1b5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
@@ -4023,6 +4023,7 @@ int amdgpu_ualink_export_handle(struct drm_device *dev,
struct drm_file *filp,
if (IS_ERR(exp_xa_node->dmabuf)) {
r = PTR_ERR(exp_xa_node->dmabuf);
dev_err(adev->dev, "Failed to generate DMABuf for the
BO\n");
+ amdgpu_bo_unref(&robj);
This would be clearer if you wrote it as
amdgpu_bo_unref(&exp_xa_node->bo);
Because that's the field that the reference got assigned to and where it
would get leaked from when you kfree(exp_xa_node). With that fixed, the
patch is
Reviewed-by: Felix Kuehling <[email protected]>
kfree(exp_xa_node);
goto out;
}
