6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wentao Liang [ Upstream commit b816da5d5df1461446a0a5f3fe2b4948a659a790 ] The firmware reference obtained via rpi_firmware_get() is leaked when aperture_remove_all_conflicting_devices() fails, as the error label returns without putting it. This happens before the firmware is consumed and put further down in the function. Put the firmware reference before jumping to err. Fixes: c406ad5e4a85 ("drm/vc4: Notify the firmware when DRM is in charge") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Link: https://patch.msgid.link/20260916154015.2056797-1-vulab@iscas.ac.cn Reviewed-by: Maíra Canal Signed-off-by: Maíra Canal [ sashal: Adapted to drm_aperture_remove_framebuffers() and its direct-return error path. ] Signed-off-by: Sasha Levin --- drivers/gpu/drm/vc4/vc4_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c index 1b3531374967e..ddeb9ffc3063a 100644 --- a/drivers/gpu/drm/vc4/vc4_drv.c +++ b/drivers/gpu/drm/vc4/vc4_drv.c @@ -351,8 +351,11 @@ static int vc4_drm_bind(struct device *dev) } ret = drm_aperture_remove_framebuffers(driver); - if (ret) + if (ret) { + if (firmware) + rpi_firmware_put(firmware); return ret; + } if (firmware) { ret = rpi_firmware_property(firmware, -- 2.53.0