RE: [PATCH] drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()

[Deucher, Alexander]

AMD General

Applied.  Thanks!

> -----Original Message-----
> From: Wentao Liang <vulab@xxxxxxxxxxx>
> Sent: Wednesday, September 16, 2026 5:56 AM
> To: Yu, Lang <Lang.Yu@xxxxxxx>
> Cc: airlied@xxxxxxxxx; Deucher, Alexander <Alexander.Deucher@xxxxxxx>;
> amd-gfx@xxxxxxxxxxxxxxxxxxxxx; Koenig, Christian
> <Christian.Koenig@xxxxxxx>; dri-devel@xxxxxxxxxxxxxxxxxxxxx; linux-
> kernel@xxxxxxxxxxxxxxx; simona@xxxxxxxx; Wentao Liang <vulab@xxxxxxxxxxx>;
> stable@xxxxxxxxxxxxxxx
> Subject: [PATCH] drm/amdgpu: Fix last_update fence leak in
> amdgpu_vm_init()
>
> amdgpu_vm_init() initializes vm->last_update, vm->last_unlocked and
> vm->last_tlb_flush with references to the stub fence taken via
> dma_fence_get_stub().  The error label at the end of the function releases the
> last_unlocked and last_tlb_flush references with dma_fence_put(), but the
> reference stored in vm->last_update is never dropped, so whenever the page
> table root creation, the reservation of the root BO or the PASID registration
> fails, the stub fence reference leaks.
>
> Drop the vm->last_update reference together with the other stub fence
> references on the error path.
>
> Fixes: 187916e6ed9d ("drm/amdgpu: install stub fence into potential unused
> fence pointers")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
> index fccd758b6699..494197ac20e8 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
> @@ -2693,6 +2693,7 @@ int amdgpu_vm_init(struct amdgpu_device *adev,
> struct amdgpu_vm *vm,
>       amdgpu_bo_unref(&root_bo);
>
>  error_free_delayed:
> +     dma_fence_put(vm->last_update);
>       dma_fence_put(vm->last_tlb_flush);
>       dma_fence_put(vm->last_unlocked);
>       ttm_lru_bulk_move_fini(&adev->mman.bdev, &vm->lru_bulk_move);
> --
> 2.34.1