On Mon, Aug 19, 2019 at 01:08:18PM -0500, Wenwen Wang wrote: > In qxl_bo_create(), the temporary 'bo' is allocated through kzalloc(). > However, it is not deallocated in the following execution if ttm_bo_init() > fails, leading to a memory leak bug. To fix this issue, free 'bo' before > returning the error. No. ttm_bo_init() calls the destroy callback (qxl_ttm_bo_destroy for qxl) on failure, which will properly cleanup 'bo' and also free it. cheers, Gerd _______________________________________________ Spice-devel mailing list Spice-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/spice-devel