From: Junrui Luo <[email protected]>

virtio_gpu_resource_create_blob_ioctl() calls drm_gem_object_release() on
both the virtio_gpu_resource_assign_uuid() and drm_gem_handle_create()
error paths instead of dropping the reference it owns, so
obj->funcs->free() never runs and the virtio_gpu_object, the resource id
and the host-side resource are leaked.

Use drm_gem_object_put() instead.

Fixes: 897b4d1acaf5 ("drm/virtio: implement blob resources: resource create 
blob ioctl")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Junrui Luo <[email protected]>
---
 drivers/gpu/drm/virtio/virtgpu_ioctl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c 
b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
index d16f07abb266..fcdb07a37972 100644
--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
@@ -557,14 +557,14 @@ static int virtio_gpu_resource_create_blob_ioctl(struct 
drm_device *dev,
        if (params.blob_flags & VIRTGPU_BLOB_FLAG_USE_CROSS_DEVICE) {
                ret = virtio_gpu_resource_assign_uuid(vgdev, bo);
                if (ret) {
-                       drm_gem_object_release(obj);
+                       drm_gem_object_put(obj);
                        return ret;
                }
        }
 
        ret = drm_gem_handle_create(file, obj, &handle);
        if (ret) {
-               drm_gem_object_release(obj);
+               drm_gem_object_put(obj);
                return ret;
        }
 

-- 
2.51.2


Reply via email to