@samitouri / QOSamiQemu / commits / db2716bce2

hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure

When virtio_gpu_create_udmabuf() succeeds but virtio_gpu_remap_udmabuf() fails (mmap returns MAP_FAILED), virtio_gpu_init_udmabuf() returns early without closing the dmabuf fd. Since res->blob is never set in this path, later cleanup via virtio_gpu_cleanup_mapping() skips virtio_gpu_fini_udmabuf() entirely, leaking the file descriptor. Call virtio_gpu_destroy_udmabuf() before the early return to close the fd. This function already handles partial state correctly: it skips the munmap when res->remapped is NULL and closes the fd when res->dmabuf_fd >= 0. Fixes: 9b60cdf98723 ("virtio-gpu: Add udmabuf helpers") Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Marc-André Lureau committed Jul 7, 2026 at 17:46 UTC db2716bce299b35b9b8259f732f80484e4cf9870

1 file changed +1

hw/display/virtio-gpu-udmabuf.c

@@ -143,6 +143,7 @@ void virtio_gpu_init_udmabuf(struct virtio_gpu_simple_resource *res)

143 }

144 virtio_gpu_remap_udmabuf(res);

145 if (!res->remapped) {

146 + virtio_gpu_destroy_udmabuf(res);

147 return;

148 }

149 pdata = res->remapped;