diff --git a/.pick_status.json b/.pick_status.json
index 95a9d7d5aa5..979c2928fa4 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -4314,7 +4314,7 @@
         "description": "turnip: msm: clean up iova on error path",
         "nominated": true,
         "nomination_type": 1,
-        "resolution": 0,
+        "resolution": 1,
         "main_sha": null,
         "because_sha": "e23c4fbd9b6b95537ab00d19a034eaffe5fe86b0",
         "notes": null
diff --git a/src/freedreno/vulkan/tu_knl_drm_msm.cc b/src/freedreno/vulkan/tu_knl_drm_msm.cc
index 581a65e0e5b..d20f4f2d0e8 100644
--- a/src/freedreno/vulkan/tu_knl_drm_msm.cc
+++ b/src/freedreno/vulkan/tu_knl_drm_msm.cc
@@ -386,6 +386,9 @@ msm_allocate_userspace_iova(struct tu_device *dev,
    int ret =
       drmCommandWriteRead(dev->fd, DRM_MSM_GEM_INFO, &req, sizeof(req));
    if (ret < 0) {
+      mtx_lock(&dev->vma_mutex);
+      util_vma_heap_free(&dev->vma, *iova, size);
+      mtx_unlock(&dev->vma_mutex);
       mesa_loge("MSM_INFO_SET_IOVA failed! %d (%s)", ret, strerror(errno));
       return VK_ERROR_OUT_OF_HOST_MEMORY;
    }
@@ -445,6 +448,11 @@ tu_bo_init(struct tu_device *dev,
       if (!new_ptr) {
          dev->bo_count--;
          mtx_unlock(&dev->bo_mutex);
+         if (dev->physical_device->has_set_iova) {
+            mtx_lock(&dev->vma_mutex);
+            util_vma_heap_free(&dev->vma, iova, size);
+            mtx_unlock(&dev->vma_mutex);
+         }
          tu_gem_close(dev, gem_handle);
          return VK_ERROR_OUT_OF_HOST_MEMORY;
       }