Commit 564c4d7e99 for qemu.org

commit 564c4d7e99d87b39c3faea52ef8759df7f786f61
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Mon Jul 13 16:56:22 2026 +0400

    hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure

    When virtio_gpu_create_udmabuf() succeeds but virtio_gpu_remap_udmabuf()
    fails (mmap returns MAP_FAILED), virtio_gpu_init_udmabuf() returns early
    without closing the dmabuf fd. Since res->blob is never set in this
    path, later cleanup via virtio_gpu_cleanup_mapping() skips
    virtio_gpu_fini_udmabuf() entirely, leaking the file descriptor.

    Call virtio_gpu_destroy_udmabuf() before the early return to close
    the fd. This function already handles partial state correctly: it
    skips the munmap when res->remapped is NULL and closes the fd when
    res->dmabuf_fd >= 0.

    Fixes: 9b60cdf98723 ("virtio-gpu: Add udmabuf helpers")
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
    Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
    Message-ID: <20260713125622.111513-1-marcandre.lureau@redhat.com>
    Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

diff --git a/hw/display/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabuf.c
index d5ac1cfca0..5f08c855dd 100644
--- a/hw/display/virtio-gpu-udmabuf.c
+++ b/hw/display/virtio-gpu-udmabuf.c
@@ -143,6 +143,7 @@ void virtio_gpu_init_udmabuf(struct virtio_gpu_simple_resource *res)
         }
         virtio_gpu_remap_udmabuf(res);
         if (!res->remapped) {
+            virtio_gpu_destroy_udmabuf(res);
             return;
         }
         pdata = res->remapped;