From 2a368a09ae1c3f7aebe6210927a1335186d3c6f7 Mon Sep 17 00:00:00 2001 From: Maarten Lankhorst Date: Tue, 25 Jul 2023 17:12:39 +0200 Subject: drm/xe: Fix error paths of __xe_bo_create_locked ttm_bo_init_reserved() calls the destroy() callback if it fails. Because of this, __xe_bo_create_locked is required to be responsible for freeing the bo even when it's passed in as argument. Additionally, if the placement check fails, the bo was kept alive. Fix it too. Reported-by: Oded Gabbay Signed-off-by: Maarten Lankhorst Reviewed-by: Matthew Brost Signed-off-by: Rodrigo Vivi --- drivers/gpu/drm/xe/xe_bo.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'drivers/gpu/drm/xe/xe_bo.c') diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c index cf0faaefd03d..a12613002766 100644 --- a/drivers/gpu/drm/xe/xe_bo.c +++ b/drivers/gpu/drm/xe/xe_bo.c @@ -1200,8 +1200,10 @@ struct xe_bo *__xe_bo_create_locked(struct xe_device *xe, struct xe_bo *bo, /* Only kernel objects should set GT */ XE_WARN_ON(tile && type != ttm_bo_type_kernel); - if (XE_WARN_ON(!size)) + if (XE_WARN_ON(!size)) { + xe_bo_free(bo); return ERR_PTR(-EINVAL); + } if (!bo) { bo = xe_bo_alloc(); @@ -1239,8 +1241,10 @@ struct xe_bo *__xe_bo_create_locked(struct xe_device *xe, struct xe_bo *bo, if (!(flags & XE_BO_FIXED_PLACEMENT_BIT)) { err = __xe_bo_placement_for_flags(xe, bo, bo->flags); - if (WARN_ON(err)) + if (WARN_ON(err)) { + xe_ttm_bo_destroy(&bo->ttm); return ERR_PTR(err); + } } /* Defer populating type_sg bos */ -- cgit