Re: [PATCH v4] Memory leak error in qxl unbind

[Greg KH]

On Sun, Aug 09, 2026 at 06:53:14PM +0200, Óscar Megía López wrote:
> I discovered an OOM after run the script below
> (I updated it and added a sleep to allow enough time for the cache to
> recover):
> 
> while [ 1 -eq 1 ]; do\
>   i=$((i+1)); echo 0000:00:01.0 > /sys/bus/pci/drivers/qxl/unbind;\
>   if (($i%1000==0)); then\
>     echo i=$i; free;\
>     grep nr_free_pages /proc/vmstat;\
>     grep -E "PageTables|VmallocUsed|Slab|Reclaimable" /proc/meminfo;\
>     sync; echo 3 > /proc/sys/vm/drop_caches;\
>     echo 1 > /proc/sys/vm/compact_memory;\
>     sleep 10s;\
>     free;\
>     grep nr_free_pages /proc/vmstat;\
>     grep -E "PageTables|VmallocUsed|Slab|Reclaimable" /proc/meminfo;\
>     uptime;\
>   fi;\
>   echo 0000:00:01.0 > /sys/bus/pci/drivers/qxl/bind;\
>  done
> 
> The OOM isn't just a simple leak; it's a refcount corruption which renders
> the list_lru fix dead code after the first mid-init failure.
> 
> Here's the chain:
> 
> Bug 1: ttm_pool_type_init() does not check return from list_lru_init().
> 
> Fix: Check the return value from list_lru_init() and propagate the error.
> 
> Bug 2: ttm_pool_fini() does not destroy list lru with list_lru_destroy().
> 
> Fix: Add list_lru_destroy() after ttm_pool_type_fini().
> 
> Bug 3: ttm_pool_mgr_init() does not check ttm_pool_type_init() return
> and does not free pool if returns error.
> 
> Fix: Move up shrinker_alloc(), check ttm_pool_type_init() return and free
> pool types and shrinker if non-zero and return error.
> 
> Bug 4: ttm_pool_mgr_fini() does not destroy the list_lru.
> 
> Fix: Add list_lru_destroy() after ttm_pool_type_fini().
> 
> Fixed check for an empty shrinker_list.

Why is this not 4 different patches as part of a series?

> This patch depends on patch ("[PATCH v3] drm/qxl: fix use-after-free in
> qxl_irq_handler on PCI"), link [1] below.

That's not going to age well in a changelog text :(

thanks,

greg k-h