dsi_tx_buf_alloc_6g() takes a reference to the kms VM with drm_gpuvm_get() and stores it in msm_host->vm. If msm_gem_kernel_new() fails, the function returns early without dropping that reference. Since msm_host->tx_gem_obj is cleared on the error path, msm_dsi_tx_buf_free() will never see a non-NULL tx_gem_obj and thus never calls drm_gpuvm_put(), leaking the VM reference. Drop the VM reference and clear msm_host->vm on the error path. Fixes: 5e05be782645 ("drm/msm/dsi: free TX buffer in unbind") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Reviewed-by: Rob Clark <rob.clark@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/754332/ Link: https://lore.kernel.org/r/20260916175738.2089950-1-vulab@iscas.ac.cn Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>