Re: [PATCH v3 1/2] drm: Add common drm_user_fence helper

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Memory leak of `drm_user_fence`, `mm_struct`, and `dma_fence` when a pending work item is successfully cancelled.
--

commit 922879f241f70a69a977d292a4790f93e66ca3e2
Author: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>

drm: Add common drm_user_fence helper

This commit introduces a common DRM user fence helper that provides a
kref-managed, MM-borrowing dma-fence-callback-to-workqueue pattern. This
allows drivers to access userspace memory from a kthread context when a
GPU fence signals.

> diff --git a/drivers/gpu/drm/drm_user_fence.c b/drivers/gpu/drm/drm_user_fence.c
> new file mode 100644
> index 0000000000000..5e6d4c1071306
> --- /dev/null
> +++ b/drivers/gpu/drm/drm_user_fence.c
[ ... ]
> +void drm_user_fence_cancel_sync(struct drm_user_fence *ufence)
> +{
> +	drm_user_fence_cancel(ufence);
> +	cancel_work_sync(&ufence->work);

[Severity: High]
Can ignoring the return value of cancel_work_sync() cause a memory leak
of the drm_user_fence, mm_struct, and an extra dma_fence reference?

If a user arms a user fence and the hardware signals it, the signal
callback drm_user_fence_cb() queues the work item. If the user then tears
down the object before the work item executes, drm_user_fence_cancel_sync()
is called.

If cancel_work_sync() successfully dequeues the pending work, it returns
true, and drm_user_fence_work() will never run. This means the call to
drm_user_fence_put() at the end of drm_user_fence_work() is skipped:

static void drm_user_fence_work(struct work_struct *w)
{
    ...
    drm_user_fence_put(ufence);
}

Leaking the mm_struct pins memory, and leaking the dma_fence can prevent GPU
resource cleanup.

Would it be safer to check the return value and drop the reference?

	if (cancel_work_sync(&ufence->work))
		drm_user_fence_put(ufence);

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260827151950.4080674-1-srinivasan.shanmugam@amd.com?part=1