From eb7897f57b4c2f3e21bec5d9e5a5fab0f4e1f5d6 Mon Sep 17 00:00:00 2001 From: Valentine Burley Date: Thu, 19 Mar 2026 20:00:05 +0100 Subject: [PATCH] tu/drm/virtio: Do not free iova from heap for lazy BOs When initializing a BO using a lazy VMA, the iova is provided by the sparse VMA and was not allocated from the device's VMA heap. Avoid calling util_vma_heap_free in the error path for such BOs to prevent heap corruption and potential double-frees. Fixes: 88d001383a7 ("tu: Add support for a "lazy" sparse VMA") Signed-off-by: Valentine Burley Part-of: --- src/freedreno/vulkan/tu_knl_drm_virtio.cc | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/freedreno/vulkan/tu_knl_drm_virtio.cc b/src/freedreno/vulkan/tu_knl_drm_virtio.cc index b03fdb1d203..df1a016c2fa 100644 --- a/src/freedreno/vulkan/tu_knl_drm_virtio.cc +++ b/src/freedreno/vulkan/tu_knl_drm_virtio.cc @@ -775,9 +775,11 @@ virtio_bo_init(struct tu_device *dev, return VK_SUCCESS; fail: - mtx_lock(&dev->vma_mutex); - util_vma_heap_free(&dev->vma, req.iova, size); - mtx_unlock(&dev->vma_mutex); + if (!lazy_vma) { + mtx_lock(&dev->vma_mutex); + util_vma_heap_free(&dev->vma, req.iova, size); + mtx_unlock(&dev->vma_mutex); + } return result; }