amdgpu_ualink_export_handle() takes an explicit amdgpu_bo_ref() before
building the exporter node, and the out: label only drops the reference
from drm_gem_object_lookup(). The xarray insert failure path unrefs the
BO, but the drm_gem_prime_handle_to_dmabuf() failure path does not.
Userspace can hit that path at will, for example by exhausting its file
descriptor table so the dmabuf export returns -EMFILE, leaking a BO
reference and its pinned VRAM on every attempt.
Fixes: 6b1a5ad90778 ("drm/amdgpu: Implement UALink handle export")
Reported-by: Sashiko-bot <[email protected]>
Signed-off-by: Mukul Joshi <[email protected]>
Reviewed-by: Felix Kuehling <[email protected]>
---
v1->v2:
- Update to using exp_xa_node->bo everywhere in the function.
drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
index d55570d083f7..6e937f31a5b1 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
@@ -4023,6 +4023,7 @@ int amdgpu_ualink_export_handle(struct drm_device *dev,
struct drm_file *filp,
if (IS_ERR(exp_xa_node->dmabuf)) {
r = PTR_ERR(exp_xa_node->dmabuf);
dev_err(adev->dev, "Failed to generate DMABuf for the
BO\n");
+ amdgpu_bo_unref(&exp_xa_node->bo);
kfree(exp_xa_node);
goto out;
}
@@ -4036,7 +4037,7 @@ int amdgpu_ualink_export_handle(struct drm_device *dev,
struct drm_file *filp,
if (r) {
dev_err(adev->dev, "Failed to insert exp_xa_node into
XA: %d\n", r);
dma_buf_put(exp_xa_node->dmabuf);
- amdgpu_bo_unref(&robj);
+ amdgpu_bo_unref(&exp_xa_node->bo);
kfree(exp_xa_node);
goto out;
}
--
2.55.0
