Commit a2f895f3c852 for kernel

commit a2f895f3c852063258d62e9f74b081de07ca95df
Author: Zhu Lingshan <lingshan.zhu@amd.com>
Date:   Wed Jul 1 18:53:21 2026 +0800

    drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved

    amdgpu_bo_create_reserved() only allocates a new BO when
    *bo_ptr (struct amdgpu_bo **bo_ptr as input parameter) is
    NULL, it simply skips creation when *bo_ptr is non-NULL.
    But it unconditionally reserves, pins, gart allocates
    and maps the BO afterwards.

    When the same non-NULL BO pointer is passed in again,
    for example firmware buffers that live in adev and are
    re-loaded on every resume / cp_resume / start
    under AMDGPU_FW_LOAD_DIRECT, amdgpu_bo_pin() just increases
    pin_count unconditionally, however the matching teardown only unpins
    once, so pin_count never drops to zero, so TTM is not able
    to move, swap or evict a BO, causing BO leaks.

    This commit fixes this issue by only pinning the bo
    once at creation, and repeated calls no longer
    take additional pin references.

    Signed-off-by: Zhu Lingshan <lingshan.zhu@amd.com>
    Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    (cherry picked from commit 3ddc0ae76202c447b6aec61e907b852bc94671cf)
    Cc: stable@vger.kernel.org

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index f98bfba59a2c..718937777e53 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -276,10 +276,12 @@ int amdgpu_bo_create_reserved(struct amdgpu_device *adev,
 		goto error_free;
 	}

-	r = amdgpu_bo_pin(*bo_ptr, domain);
-	if (r) {
-		dev_err(adev->dev, "(%d) kernel bo pin failed\n", r);
-		goto error_unreserve;
+	if (free) {
+		r = amdgpu_bo_pin(*bo_ptr, domain);
+		if (r) {
+			dev_err(adev->dev, "(%d) kernel bo pin failed\n", r);
+			goto error_unreserve;
+		}
 	}

 	r = amdgpu_ttm_alloc_gart(&(*bo_ptr)->tbo);
@@ -302,7 +304,8 @@ int amdgpu_bo_create_reserved(struct amdgpu_device *adev,
 	return 0;

 error_unpin:
-	amdgpu_bo_unpin(*bo_ptr);
+	if (free)
+		amdgpu_bo_unpin(*bo_ptr);
 error_unreserve:
 	amdgpu_bo_unreserve(*bo_ptr);