Re: [PATCH V1] accel/amdxdna: fix open_ref leak and stale client pointer on dma map failure

[Max Zhen]

On 7/6/2026 Mon 22:56, Lizhi Hou wrote:
> amdxdna_gem_obj_open() increments open_ref before attempting to set up
> the DMA address mapping.  When amdxdna_dma_map_bo() fails, the function
> returned immediately without rolling back either change made on the first
> open (open_ref == 1 path).
>
> Fix it by decrementing open_ref and clearing abo->client on the error path.
>
> Fixes: ece3e8980907 ("accel/amdxdna: Allow forcing IOVA-based DMA via module parameter")
> Signed-off-by: Lizhi Hou <lizhi.hou@xxxxxxx>
Reviewed-by: Max Zhen <max.zhen@xxxxxxx>
> ---
>   drivers/accel/amdxdna/amdxdna_gem.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
> index a4bd9e86bc8d..3f03d2db1603 100644
> --- a/drivers/accel/amdxdna/amdxdna_gem.c
> +++ b/drivers/accel/amdxdna/amdxdna_gem.c
> @@ -663,8 +663,11 @@ static int amdxdna_gem_obj_open(struct drm_gem_object *gobj, struct drm_file *fi
>   	/* No need to set up dma addr mapping in PASID mode. */
>   	if (!amdxdna_pasid_on(abo->client)) {
>   		ret = amdxdna_dma_map_bo(xdna, abo);
> -		if (ret)
> +		if (ret) {
> +			abo->open_ref--;
> +			abo->client = NULL;
>   			return ret;
> +		}
>   	}
>   
>   	amdxdna_gem_add_bo_usage(abo);