Re: [PATCH v2] drm/tegra: fix host1x_bo_pin leak in tegra_dc_pin error path

[Mikko Perttunen]

On Monday, June 29, 2026 12:02 AM WenTao Liang wrote:
> When map->chunks > 1 triggers an error, the function jumps to unpin
> before storing the current map in state->map[i]. The unpin loop only
> cleans up previously pinned planes (indices 0 through i-1), so the
> current mapping returned by host1x_bo_pin is never released via
> host1x_bo_unpin.
> 
> Suggested-by: Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx>
> Fixes: c6aeaf56f468 ("drm/tegra: Implement correct DMA-BUF semantics")

This patch changes the code around the line, but doesn't look like it's
the origin of the bug. Rather, I think commit

  49f821919bb9d45de7f1cde6072de01d36235b5d

is the origin.

Aside from that,

Reviewed-by: Mikko Perttunen <mperttunen@xxxxxxxxxx>

..

Sashiko[1] reports similar issue(s) in gpu/host1x/job.c. Would you be
interested in fixing that as well? Otherwise I'll take care of it.

[1] https://sashiko.dev/#/patchset/20260628150228.47948-1-vulab%40iscas.ac.cn

Thank you!
Mikko

> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
> ---
> Changes in v2:
> - Fix patch format based on reviewer feedback
> ---
>  drivers/gpu/drm/tegra/plane.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/gpu/drm/tegra/plane.c b/drivers/gpu/drm/tegra/plane.c
> index 0cb30910773f..e61485ee58f6 100644
> --- a/drivers/gpu/drm/tegra/plane.c
> +++ b/drivers/gpu/drm/tegra/plane.c
> @@ -161,6 +161,7 @@ static int tegra_dc_pin(struct tegra_dc *dc, struct tegra_plane_state *state)
>  			 */
>  			if (map->chunks > 1) {
>  				err = -EINVAL;
> +				host1x_bo_unpin(map);
>  				goto unpin;
>  			}
>  
> -- 
> 2.39.5 (Apple Git-154)
> 
>