[PATCH] ttm/pool: Don't leak LRU list on shutdown

[PATCH] ttm/pool: Don't leak LRU list on shutdown

[Ian Forbes]

TTM pool was changed from a regular list to an lru list in the
referenced fixes commit. list_lru_init allocates state and it needs to
be freed unlike a simple list.

Found using the igt@core_hotunplug and kmemleak.

Fixes: 444e2a19d7fd ("ttm/pool: port to list_lru. (v2)")
Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
---
 drivers/gpu/drm/ttm/ttm_pool.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/ttm/ttm_pool.c b/drivers/gpu/drm/ttm/ttm_pool.c
index 26a3689e5fd9..a41addbf3ddf 100644
--- a/drivers/gpu/drm/ttm/ttm_pool.c
+++ b/drivers/gpu/drm/ttm/ttm_pool.c
@@ -395,6 +395,7 @@ static void ttm_pool_type_fini(struct ttm_pool_type *pt)
 
 	list_lru_walk(&pt->pages, pool_move_to_dispose_list, &dispose, LONG_MAX);
 	ttm_pool_dispose_list(pt, &dispose);
+	list_lru_destroy(&pt->pages);
 }
 
 /* Return the pool_type to use for the given caching and order */
-- 
2.54.0

Claude review: ttm/pool: Don't leak LRU list on shutdown

[Claude Code Review Bot]

Overall Series Review

Subject: ttm/pool: Don't leak LRU list on shutdown
Author: Ian Forbes <ian.forbes@broadcom.com>
Patches: 1
Reviewed: 2026-05-28T12:06:59.833344

---

This is a single-patch fix for a memory leak in the TTM pool subsystem. The analysis is straightforward and correct: commit `444e2a19d7fd` changed `pt->pages` from a plain `list_head` to a `list_lru`, which requires `list_lru_init()` at creation and `list_lru_destroy()` at teardown. The init call was added (line 357) but the corresponding destroy was missed in `ttm_pool_type_fini()`. This would leak per-node `list_lru_node` allocations every time a pool type is torn down, as confirmed by the author via kmemleak + `igt@core_hotunplug`.

The fix is minimal, correctly placed, and the series is ready to merge.

---
Generated by Claude Code Patch Reviewer

Claude review: ttm/pool: Don't leak LRU list on shutdown

[Claude Code Review Bot]

Patch Review

**Correctness: Good.** The added `list_lru_destroy(&pt->pages)` is placed after the LRU walk and dispose, which is the right ordering — all entries are drained first, then the LRU infrastructure is freed. This mirrors the standard `list_lru_init` / `list_lru_destroy` lifecycle used throughout the kernel.

**Placement within `ttm_pool_type_fini`:**

```c
list_lru_walk(&pt->pages, pool_move_to_dispose_list, &dispose, LONG_MAX);
ttm_pool_dispose_list(pt, &dispose);
list_lru_destroy(&pt->pages);
```

The destroy comes after draining, which is correct. Calling `list_lru_destroy` on a non-empty LRU would be a bug, but the walk + dispose above guarantee it's empty.

**Commit message:** Clear and concise. The `Fixes:` tag correctly references the commit that introduced the `list_lru` conversion. The description of how it was found (kmemleak + igt hotunplug) is helpful for reviewers.

**No issues found.** This is a clean, correct one-line fix.

Reviewed-by assessment: **Accept.** No changes needed.

---
Generated by Claude Code Patch Reviewer