Re: [PATCH] drm/msm: Fix a lock leak in msm_ioctl_gem_info_set_metadata()

[Rob Clark]

On Mon, Oct 26, 2026 at 12:58 PM Bart Van Assche <bvanassche@xxxxxxx> wrote:
>
> If krealloc() fails, msm_ioctl_gem_info_set_metadata() returns without
> unlocking the GEM object. Fix this by jumping to a new label that
> unlocks the GEM object before the buffer is freed. This bug has been
> detected by the Clang thread-safety analyzer.
>
> Fixes: 1c8c354098ea ("drm/msm: Add error handling for krealloc in metadata setup")
> Signed-off-by: Bart Van Assche <bvanassche@xxxxxxx>

You nerd-sniped me into:
https://lore.kernel.org/all/20261026213701.22126-1-robin.clark@xxxxxxxxxxxxxxxx/

(but I'll take your patch for -fixes and rebase mine on top)

BR,
-R

> ---
>  drivers/gpu/drm/msm/msm_drv.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
> index 5e8f3ce26b32..7ab808322be6 100644
> --- a/drivers/gpu/drm/msm/msm_drv.c
> +++ b/drivers/gpu/drm/msm/msm_drv.c
> @@ -571,13 +571,14 @@ static int msm_ioctl_gem_info_set_metadata(struct drm_gem_object *obj,
>                 krealloc(msm_obj->metadata, metadata_size, GFP_KERNEL);
>         if (!new_metadata) {
>                 ret = -ENOMEM;
> -               goto out;
> +               goto unlock;
>         }
>
>         msm_obj->metadata = new_metadata;
>         msm_obj->metadata_size = metadata_size;
>         memcpy(msm_obj->metadata, buf, metadata_size);
>
> +unlock:
>         msm_gem_unlock(obj);
>
>  out: