vmw_gem_object_create_with_handle() leaves the allocation reference with its caller, including when drm_gem_handle_create() fails. The allocation ioctl currently skips dropping that reference on this error path, leaking the buffer object and its backing storage. Drop the allocation reference at the common exit when an object was allocated. Keep the helper ownership rules unchanged, as its other callers already release the returned object on failure. Fixes: 9ef8d83e8e25 ("drm/vmwgfx: Do not drop the reference to the handle too soon") Cc: stable@vger.kernel.org Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex Signed-off-by: Wentao Liang --- drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c index 39f8c46550c2..fd5b84744f88 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c @@ -233,9 +233,10 @@ int vmw_gem_object_create_ioctl(struct drm_device *dev, void *data, rep->map_handle = drm_vma_node_offset_addr(&vbo->tbo.base.vma_node); rep->cur_gmr_id = handle; rep->cur_gmr_offset = 0; - /* drop reference from allocate - handle holds it now */ - drm_gem_object_put(&vbo->tbo.base); out_no_bo: + /* Drop the allocation reference even if handle creation failed. */ + if (vbo) + drm_gem_object_put(&vbo->tbo.base); return ret; } -- 2.34.1