6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wentao Liang [ Upstream commit ab91ba61871a896ca2ecc6e048d80a152136da44 ] dsi_tx_buf_alloc_6g() takes a reference to the kms VM with drm_gpuvm_get() and stores it in msm_host->vm. If msm_gem_kernel_new() fails, the function returns early without dropping that reference. Since msm_host->tx_gem_obj is cleared on the error path, msm_dsi_tx_buf_free() will never see a non-NULL tx_gem_obj and thus never calls drm_gpuvm_put(), leaking the VM reference. Drop the VM reference and clear msm_host->vm on the error path. Fixes: 5e05be782645 ("drm/msm/dsi: free TX buffer in unbind") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Reviewed-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/754332/ Link: https://lore.kernel.org/r/20260916175738.2089950-1-vulab@iscas.ac.cn Signed-off-by: Dmitry Baryshkov Signed-off-by: Sasha Levin --- drivers/gpu/drm/msm/dsi/dsi_host.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c index 4e93f8dd39d7d..1827af24a3fa1 100644 --- a/drivers/gpu/drm/msm/dsi/dsi_host.c +++ b/drivers/gpu/drm/msm/dsi/dsi_host.c @@ -1254,6 +1254,8 @@ int dsi_tx_buf_alloc_6g(struct msm_dsi_host *msm_host, int size) if (IS_ERR(data)) { msm_host->tx_gem_obj = NULL; + drm_gpuvm_put(msm_host->vm); + msm_host->vm = NULL; return PTR_ERR(data); } -- 2.53.0