Re: [PATCH v4] Memory leak error in qxl unbind
From: Oscar Megia López
Date: Fri Aug 21 2026 - 10:50:18 EST
On 8/9/26 20:19, Greg KH wrote:
On Sun, Aug 09, 2026 at 06:53:14PM +0200, Óscar Megía López wrote:I'm a newbie. What's the best way to add a patch it depends on?
I discovered an OOM after run the script belowWhy is this not 4 different patches as part of a series?
(I updated it and added a sleep to allow enough time for the cache to
recover):
while [ 1 -eq 1 ]; do\
i=$((i+1)); echo 0000:00:01.0 > /sys/bus/pci/drivers/qxl/unbind;\
if (($i%1000==0)); then\
echo i=$i; free;\
grep nr_free_pages /proc/vmstat;\
grep -E "PageTables|VmallocUsed|Slab|Reclaimable" /proc/meminfo;\
sync; echo 3 > /proc/sys/vm/drop_caches;\
echo 1 > /proc/sys/vm/compact_memory;\
sleep 10s;\
free;\
grep nr_free_pages /proc/vmstat;\
grep -E "PageTables|VmallocUsed|Slab|Reclaimable" /proc/meminfo;\
uptime;\
fi;\
echo 0000:00:01.0 > /sys/bus/pci/drivers/qxl/bind;\
done
The OOM isn't just a simple leak; it's a refcount corruption which renders
the list_lru fix dead code after the first mid-init failure.
Here's the chain:
Bug 1: ttm_pool_type_init() does not check return from list_lru_init().
Fix: Check the return value from list_lru_init() and propagate the error.
Bug 2: ttm_pool_fini() does not destroy list lru with list_lru_destroy().
Fix: Add list_lru_destroy() after ttm_pool_type_fini().
Bug 3: ttm_pool_mgr_init() does not check ttm_pool_type_init() return
and does not free pool if returns error.
Fix: Move up shrinker_alloc(), check ttm_pool_type_init() return and free
pool types and shrinker if non-zero and return error.
Bug 4: ttm_pool_mgr_fini() does not destroy the list_lru.
Fix: Add list_lru_destroy() after ttm_pool_type_fini().
Fixed check for an empty shrinker_list.
This patch depends on patch ("[PATCH v3] drm/qxl: fix use-after-free inThat's not going to age well in a changelog text :(
qxl_irq_handler on PCI"), link [1] below.
thanks,
greg k-h