[PATCH] drm/qxl: fix local_gobj leak in qxl_gem_object_create_with_handle

[PATCH] drm/qxl: fix local_gobj leak in qxl_gem_object_create_with_handle

[Hongtao Lee]

If drm_gem_handle_create fails, the reference count of local_gobj
will never be released, resulting in a leak of local_gobj.

Fixes: f64122c1f6ad("drm: add new QXL driver. (v1.4)")
Signed-off-by: Hongtao Lee <lihongtao@kylinos.cn>
---
 drivers/gpu/drm/qxl/qxl_gem.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/qxl/qxl_gem.c b/drivers/gpu/drm/qxl/qxl_gem.c
index 4939b57a2a48..2bdff4cee952 100644
--- a/drivers/gpu/drm/qxl/qxl_gem.c
+++ b/drivers/gpu/drm/qxl/qxl_gem.c
@@ -99,8 +99,10 @@ int qxl_gem_object_create_with_handle(struct qxl_device *qdev,
 	if (r)
 		return -ENOMEM;
 	r = drm_gem_handle_create(file_priv, local_gobj, handle);
-	if (r)
+	if (r) {
+		drm_gem_object_put(local_gobj);
 		return r;
+	}
 
 	if (gobj)
 		*gobj = local_gobj;
-- 
2.25.1

Claude review: drm/qxl: fix local_gobj leak in qxl_gem_object_create_with_handle

[Claude Code Review Bot]

Overall Series Review

Subject: drm/qxl: fix local_gobj leak in qxl_gem_object_create_with_handle
Author: Hongtao Lee <lihongtao@kylinos.cn>
Patches: 1
Reviewed: 2026-06-04T14:38:32.055574

---

This is a single-patch series that fixes a real GEM object reference leak in the QXL driver. The analysis is correct: when `qxl_gem_object_create()` succeeds, it returns a GEM object with a reference count. If the subsequent `drm_gem_handle_create()` call fails, the original code returned the error without dropping that reference, leaking the object.

The fix is straightforward, correct, and follows established kernel patterns for GEM object cleanup. It's a clear bug that has existed since the QXL driver was first introduced.

**Verdict: Good patch. Recommend applying.**

---
Generated by Claude Code Patch Reviewer

Claude review: drm/qxl: fix local_gobj leak in qxl_gem_object_create_with_handle

[Claude Code Review Bot]

Patch Review

**Bug analysis is correct.** Looking at the function in `drivers/gpu/drm/qxl/qxl_gem.c:82-114`:

1. `qxl_gem_object_create()` (line 95) creates a GEM object and returns it via `local_gobj` with a reference held.
2. `drm_gem_handle_create()` (line 101) takes its own reference on the object if it succeeds.
3. If `drm_gem_handle_create()` fails, the original code returned `r` immediately without dropping the reference from step 1 — leaking the object.

**The fix is correct:**
```c
r = drm_gem_handle_create(file_priv, local_gobj, handle);
if (r) {
    drm_gem_object_put(local_gobj);
    return r;
}
```

Adding `drm_gem_object_put(local_gobj)` in the error path properly releases the reference obtained from `qxl_gem_object_create()`.

**Note the existing code on the success path** (lines 107-111) already demonstrates the correct pattern — when `gobj` is NULL, it drops the allocate reference since the handle holds one. The error path was simply missing the same cleanup.

**Minor nit on the Fixes tag format:** The tag reads `Fixes: f64122c1f6ad("drm: add new QXL driver. (v1.4)")` but the standard kernel format has a space before the parenthesis: `Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")`. This is cosmetic but worth fixing for consistency with `gitlint` and kernel conventions.

**No other issues.** The patch is minimal, correctly scoped, and addresses a real resource leak that has existed since the driver was introduced.

---
Generated by Claude Code Patch Reviewer