[PATCH v2] drm/tegra: Fix dma-buf reference on import errors

[Karl Mehltretter]

tegra_bo_import() takes its own dma-buf reference only on success, but if
mapping fails, its detach error path still calls dma_buf_put(). That drops
the reference held by the PRIME caller, which then puts it again, and can
release the dma-buf file while its descriptor is still installed:

  VFS: Close: file count is 0 (f_op=dma_buf_fops)

Remove the unmatched put.

Fixes: f5b8794e17e4 ("drm/tegra: gem: Don't attach dma-bufs when not needed")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
---
v2: Clean up the commit message (Mikko). No code change.
v1: https://lore.kernel.org/r/20261026055842.96484-1-kmehltretter@xxxxxxxxx/

Tested on a Jetson Nano (p3450-0000) with CONFIG_DMABUF_DEBUG=y and a local
change that rejects zero-byte IOMMU mappings to force the error path. Without
this patch the forced failure produced the warning above. With it, 100
consecutive failures returned -EINVAL, kept the original dma-buf fd and left
no dma-buf objects.

 drivers/gpu/drm/tegra/gem.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
index f76af73..ed35a34 100644
--- a/drivers/gpu/drm/tegra/gem.c
+++ b/drivers/gpu/drm/tegra/gem.c
@@ -502,7 +502,6 @@ detach:
 		dma_buf_unmap_attachment_unlocked(attach, bo->sgt, DMA_TO_DEVICE);
 
 	dma_buf_detach(buf, attach);
-	dma_buf_put(buf);
 free:
 	drm_gem_object_release(&bo->gem);
 	kfree(bo);

base-commit: 21a7f44fd0765fcc5194130b28767786eba1d1e7
-- 
2.39.5 (Apple Git-154)