[PATCH] drm/etnaviv: erase context from active_contexts on open failure

From: Changyul Lee

Date: Mon Sep 07 2026 - 17:00:18 EST


etnaviv_open() allocates an ID in priv->active_contexts for the new
struct etnaviv_file_private. When etnaviv_iommu_context_init() fails,
the error path frees ctx but does not remove the entry from the
XArray, so the entry keeps a dangling pointer.

Erase the entry before freeing the context on that path.

Fixes: d306788b6e1b ("drm/etnaviv: allocate unique ID per drm_file")

Signed-off-by: Changyul Lee <lcy8047@xxxxxxxxx>
---
drivers/gpu/drm/etnaviv/etnaviv_drv.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_drv.c b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
index 08aca9035fc1..ceb8c00d66c0 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_drv.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
@@ -79,7 +79,7 @@ static int etnaviv_open(struct drm_device *dev, struct drm_file *file)
priv->cmdbuf_suballoc);
if (!ctx->mmu) {
ret = -ENOMEM;
- goto out_free;
+ goto out_free_id;
}

for (i = 0; i < ETNA_MAX_PIPES; i++) {
@@ -98,6 +98,8 @@ static int etnaviv_open(struct drm_device *dev, struct drm_file *file)

return 0;

+out_free_id:
+ xa_erase(&priv->active_contexts, ctx->id);
out_free:
kfree(ctx);
return ret;
--
2.43.0