Re: [PATCH v4] Memory leak error in qxl unbind

On 8/9/26 20:19, Greg KH wrote:

On Sun, Aug 09, 2026 at 06:53:14PM +0200, Óscar Megía López wrote:

quoted

I discovered an OOM after run the script below
(I updated it and added a sleep to allow enough time for the cache to
recover):

while [ 1 -eq 1 ]; do\
   i=$((i+1)); echo 0000:00:01.0 > /sys/bus/pci/drivers/qxl/unbind;\
   if (($i%1000==0)); then\
     echo i=$i; free;\
     grep nr_free_pages /proc/vmstat;\
     grep -E "PageTables|VmallocUsed|Slab|Reclaimable" /proc/meminfo;\
     sync; echo 3 > /proc/sys/vm/drop_caches;\
     echo 1 > /proc/sys/vm/compact_memory;\
     sleep 10s;\
     free;\
     grep nr_free_pages /proc/vmstat;\
     grep -E "PageTables|VmallocUsed|Slab|Reclaimable" /proc/meminfo;\
     uptime;\
   fi;\
   echo 0000:00:01.0 > /sys/bus/pci/drivers/qxl/bind;\
  done

The OOM isn't just a simple leak; it's a refcount corruption which renders
the list_lru fix dead code after the first mid-init failure.

Here's the chain:

Bug 1: ttm_pool_type_init() does not check return from list_lru_init().

Fix: Check the return value from list_lru_init() and propagate the error.

Bug 2: ttm_pool_fini() does not destroy list lru with list_lru_destroy().

Fix: Add list_lru_destroy() after ttm_pool_type_fini().

Bug 3: ttm_pool_mgr_init() does not check ttm_pool_type_init() return
and does not free pool if returns error.

Fix: Move up shrinker_alloc(), check ttm_pool_type_init() return and free
pool types and shrinker if non-zero and return error.

Bug 4: ttm_pool_mgr_fini() does not destroy the list_lru.

Fix: Add list_lru_destroy() after ttm_pool_type_fini().

Fixed check for an empty shrinker_list.

Why is this not 4 different patches as part of a series?

quoted

This patch depends on patch ("[PATCH v3] drm/qxl: fix use-after-free in
qxl_irq_handler on PCI"), link [1] below.

That's not going to age well in a changelog text :(

I'm a newbie. What's the best way to add a patch it depends on?

thanks,

greg k-h