> From: Junrui Luo <[email protected]> > > virtio_gpu_vram_create() frees the object with a bare kfree(vram) on > both error paths after drm_gem_private_object_init() has run, and on the > second one after drm_gem_create_mmap_offset() has linked obj->vma_node > into the device's VMA offset manager. The freed object stays in that > interval tree, so a later lookup or insertion walks freed memory, and > the dma_resv and gpuva lock are never destroyed. > > Call drm_gem_object_release() before kfree() on both paths. > > Fixes: 16845c5d5409 ("drm/virtio: implement blob resources: implement vram > object") > Assisted-by: Claude:claude-opus-5 > Signed-off-by: Junrui Luo <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=4
