Re: [PATCH v4] Memory leak error in qxl unbind

On 8/9/26 20:19, Greg KH wrote:
> On Sun, Aug 09, 2026 at 06:53:14PM +0200, Óscar Megía López wrote:
>> I discovered an OOM after run the script below
>> (I updated it and added a sleep to allow enough time for the cache to
>> recover):
>>
>> while [ 1 -eq 1 ]; do\
>>    i=$((i+1)); echo 0000:00:01.0 > /sys/bus/pci/drivers/qxl/unbind;\
>>    if (($i%1000==0)); then\
>>      echo i=$i; free;\
>>      grep nr_free_pages /proc/vmstat;\
>>      grep -E "PageTables|VmallocUsed|Slab|Reclaimable" /proc/meminfo;\
>>      sync; echo 3 > /proc/sys/vm/drop_caches;\
>>      echo 1 > /proc/sys/vm/compact_memory;\
>>      sleep 10s;\
>>      free;\
>>      grep nr_free_pages /proc/vmstat;\
>>      grep -E "PageTables|VmallocUsed|Slab|Reclaimable" /proc/meminfo;\
>>      uptime;\
>>    fi;\
>>    echo 0000:00:01.0 > /sys/bus/pci/drivers/qxl/bind;\
>>   done
>>
>> The OOM isn't just a simple leak; it's a refcount corruption which renders
>> the list_lru fix dead code after the first mid-init failure.
>>
>> Here's the chain:
>>
>> Bug 1: ttm_pool_type_init() does not check return from list_lru_init().
>>
>> Fix: Check the return value from list_lru_init() and propagate the error.
>>
>> Bug 2: ttm_pool_fini() does not destroy list lru with list_lru_destroy().
>>
>> Fix: Add list_lru_destroy() after ttm_pool_type_fini().
>>
>> Bug 3: ttm_pool_mgr_init() does not check ttm_pool_type_init() return
>> and does not free pool if returns error.
>>
>> Fix: Move up shrinker_alloc(), check ttm_pool_type_init() return and free
>> pool types and shrinker if non-zero and return error.
>>
>> Bug 4: ttm_pool_mgr_fini() does not destroy the list_lru.
>>
>> Fix: Add list_lru_destroy() after ttm_pool_type_fini().
>>
>> Fixed check for an empty shrinker_list.
> Why is this not 4 different patches as part of a series?
>
>> This patch depends on patch ("[PATCH v3] drm/qxl: fix use-after-free in
>> qxl_irq_handler on PCI"), link [1] below.
> That's not going to age well in a changelog text :(
I'm a newbie. What's the best way to add a patch it depends on?
>
> thanks,
>
> greg k-h