diff options
| author | Shuicheng Lin <shuicheng.lin@intel.com> | 2026-06-26 21:06:31 +0000 |
|---|---|---|
| committer | Shuicheng Lin <shuicheng.lin@intel.com> | 2026-06-29 15:22:43 -0700 |
| commit | e459a3bdeb117be496d7f229e2ea1f6c9fe4080b (patch) | |
| tree | 5ae10a6b0513a409d790625a4b9f33dfcb06b69c | |
| parent | ed382e3b07fae51a09d7290485bff0592f6b168b (diff) | |
| download | linux-e459a3bdeb117be496d7f229e2ea1f6c9fe4080b.tar.gz linux-e459a3bdeb117be496d7f229e2ea1f6c9fe4080b.zip | |
drm/xe/hw_engine: Fix double-free of managed BO in error path
The error path in hw_engine_init() explicitly frees a BO allocated
with xe_managed_bo_create_pin_map() via xe_bo_unpin_map_no_vm().
Since the managed BO already has a devm cleanup action registered,
this causes a double-free when devm unwinds during probe failure.
Remove the explicit free and let devm handle it, consistent with
all other xe_managed_bo_create_pin_map() callers.
Fixes: 0e1a47fcabc8 ("drm/xe: Add a helper for DRM device-lifetime BO create")
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: Zongyao Bai <zongyao.bai@intel.com>
Link: https://patch.msgid.link/20260626210631.3887291-1-shuicheng.lin@intel.com
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
| -rw-r--r-- | drivers/gpu/drm/xe/xe_hw_engine.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/drivers/gpu/drm/xe/xe_hw_engine.c b/drivers/gpu/drm/xe/xe_hw_engine.c index 76aee461bcbe..87d60c4117bd 100644 --- a/drivers/gpu/drm/xe/xe_hw_engine.c +++ b/drivers/gpu/drm/xe/xe_hw_engine.c @@ -636,7 +636,7 @@ static int hw_engine_init(struct xe_gt *gt, struct xe_hw_engine *hwe, hwe->exl_port = xe_execlist_port_create(xe, hwe); if (IS_ERR(hwe->exl_port)) { err = PTR_ERR(hwe->exl_port); - goto err_hwsp; + goto err_name; } } else { /* GSCCS has a special interrupt for reset */ @@ -656,8 +656,6 @@ static int hw_engine_init(struct xe_gt *gt, struct xe_hw_engine *hwe, return devm_add_action_or_reset(xe->drm.dev, hw_engine_fini, hwe); -err_hwsp: - xe_bo_unpin_map_no_vm(hwe->hwsp); err_name: hwe->name = NULL; |