@samitouri / QOSamiQemu / commits / 564c4d7e99

hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure

When virtio_gpu_create_udmabuf() succeeds but virtio_gpu_remap_udmabuf() fails (mmap returns MAP_FAILED), virtio_gpu_init_udmabuf() returns early without closing the dmabuf fd. Since res->blob is never set in this path, later cleanup via virtio_gpu_cleanup_mapping() skips virtio_gpu_fini_udmabuf() entirely, leaking the file descriptor. Call virtio_gpu_destroy_udmabuf() before the early return to close the fd. This function already handles partial state correctly: it skips the munmap when res->remapped is NULL and closes the fd when res->dmabuf_fd >= 0. Fixes: 9b60cdf98723 ("virtio-gpu: Add udmabuf helpers") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Message-ID: <20260713125622.111513-1-marcandre.lureau@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

Marc-André Lureau committed Jul 13, 2026 at 16:56 UTC 564c4d7e99d87b39c3faea52ef8759df7f786f61

1 file changed +1

hw/display/virtio-gpu-udmabuf.c

@@ -143,6 +143,7 @@ void virtio_gpu_init_udmabuf(struct virtio_gpu_simple_resource *res)

143 }

144 virtio_gpu_remap_udmabuf(res);

145 if (!res->remapped) {

146 + virtio_gpu_destroy_udmabuf(res);

147 return;

148 }

149 pdata = res->remapped;