From 564c4d7e99d87b39c3faea52ef8759df7f786f61 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Mon, 13 Jul 2026 16:56:22 +0400 Subject: [PATCH] hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When virtio_gpu_create_udmabuf() succeeds but virtio_gpu_remap_udmabuf() fails (mmap returns MAP_FAILED), virtio_gpu_init_udmabuf() returns early without closing the dmabuf fd. Since res->blob is never set in this path, later cleanup via virtio_gpu_cleanup_mapping() skips virtio_gpu_fini_udmabuf() entirely, leaking the file descriptor. Call virtio_gpu_destroy_udmabuf() before the early return to close the fd. This function already handles partial state correctly: it skips the munmap when res->remapped is NULL and closes the fd when res->dmabuf_fd >= 0. Fixes: 9b60cdf98723 ("virtio-gpu: Add udmabuf helpers") Signed-off-by: Marc-André Lureau Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Dmitry Osipenko Reviewed-by: Akihiko Odaki Message-ID: <20260713125622.111513-1-marcandre.lureau@redhat.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/display/virtio-gpu-udmabuf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/display/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabuf.c index d5ac1cfca0..5f08c855dd 100644 --- a/hw/display/virtio-gpu-udmabuf.c +++ b/hw/display/virtio-gpu-udmabuf.c @@ -143,6 +143,7 @@ void virtio_gpu_init_udmabuf(struct virtio_gpu_simple_resource *res) } virtio_gpu_remap_udmabuf(res); if (!res->remapped) { + virtio_gpu_destroy_udmabuf(res); return; } pdata = res->remapped;