[PATCH] drm/xe: fix refcount leak in xe_range_fence_insert()

[PATCH] drm/xe: fix refcount leak in xe_range_fence_insert()

[Wentao Liang]

xe_range_fence_insert() acquires a reference on fence via
dma_fence_get() and stores it in rfence->fence.  It then calls
dma_fence_add_callback() and handles two cases: when the callback
is successfully registered (err == 0) the fence is transferred to
the tree for later cleanup; when the fence is already signaled
(err == -ENOENT) it manually drops the extra reference with
dma_fence_put(fence).

However, dma_fence_add_callback() can fail with other errors
(e.g. -EINVAL) and in that case the code falls through to the free:
label without releasing the acquired reference, leaking it.

Fix the leak by adding an else branch that calls dma_fence_put()
before jumping to free: for any error other than -ENOENT.

Cc: stable@vger.kernel.org
Fixes: 845f64bdbfc9 ("drm/xe: Introduce a range-fence utility")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/xe/xe_range_fence.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/xe/xe_range_fence.c b/drivers/gpu/drm/xe/xe_range_fence.c
index 372378e89e98..3d8fa194a7b0 100644
--- a/drivers/gpu/drm/xe/xe_range_fence.c
+++ b/drivers/gpu/drm/xe/xe_range_fence.c
@@ -77,6 +77,8 @@ int xe_range_fence_insert(struct xe_range_fence_tree *tree,
 	} else if (err == 0) {
 		xe_range_fence_tree_insert(rfence, &tree->root);
 		return 0;
+	} else {
+		dma_fence_put(fence);
 	}
 
 free:
-- 
2.34.1

Re: [PATCH] drm/xe: fix refcount leak in xe_range_fence_insert()

[Thomas Hellström]

On Mon, 2026-06-08 at 06:15 +0000, Wentao Liang wrote:
> xe_range_fence_insert() acquires a reference on fence via
> dma_fence_get() and stores it in rfence->fence.  It then calls
> dma_fence_add_callback() and handles two cases: when the callback
> is successfully registered (err == 0) the fence is transferred to
> the tree for later cleanup; when the fence is already signaled
> (err == -ENOENT) it manually drops the extra reference with
> dma_fence_put(fence).
> 
> However, dma_fence_add_callback() can fail with other errors
> (e.g. -EINVAL) and in that case the code falls through to the free:
> label without releasing the acquired reference, leaking it.
> 
> Fix the leak by adding an else branch that calls dma_fence_put()
> before jumping to free: for any error other than -ENOENT.

In practice this can't happen since other errors require a missing
fence or ops.

But OTOH let's future-proof it.

> 
> Cc: stable@vger.kernel.org
> Fixes: 845f64bdbfc9 ("drm/xe: Introduce a range-fence utility")
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>

Will merge when it has passed CI.

Thanks,
Thomas


> ---
>  drivers/gpu/drm/xe/xe_range_fence.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/gpu/drm/xe/xe_range_fence.c
> b/drivers/gpu/drm/xe/xe_range_fence.c
> index 372378e89e98..3d8fa194a7b0 100644
> --- a/drivers/gpu/drm/xe/xe_range_fence.c
> +++ b/drivers/gpu/drm/xe/xe_range_fence.c
> @@ -77,6 +77,8 @@ int xe_range_fence_insert(struct
> xe_range_fence_tree *tree,
>  	} else if (err == 0) {
>  		xe_range_fence_tree_insert(rfence, &tree->root);
>  		return 0;
> +	} else {
> +		dma_fence_put(fence);
>  	}
>  
>  free:

✗ LGCI.VerificationFailed: failure for drm/xe: fix refcount leak in xe_range_fence_insert()

[Patchwork]

== Series Details ==

Series: drm/xe: fix refcount leak in xe_range_fence_insert()
URL   : https://patchwork.freedesktop.org/series/168085/
State : failure

== Summary ==

Address 'vulab@iscas.ac.cn' is not on the allowlist, which prevents CI from being triggered for this patch.
If you want Intel GFX CI to accept this address, please contact the script maintainers at i915-ci-infra@lists.freedesktop.org.
Exception occurred during validation, bailing out!
Build URL: http://intel-gfx-ci-public.igk.intel.com:8080/job/xe_pw_trigger/1183646/ (on master)

Re: [PATCH] drm/xe: fix refcount leak in xe_range_fence_insert()

[Matthew Brost]

On Mon, Jun 08, 2026 at 06:15:40AM +0000, Wentao Liang wrote:
> xe_range_fence_insert() acquires a reference on fence via
> dma_fence_get() and stores it in rfence->fence.  It then calls
> dma_fence_add_callback() and handles two cases: when the callback
> is successfully registered (err == 0) the fence is transferred to
> the tree for later cleanup; when the fence is already signaled
> (err == -ENOENT) it manually drops the extra reference with
> dma_fence_put(fence).
> 
> However, dma_fence_add_callback() can fail with other errors
> (e.g. -EINVAL) and in that case the code falls through to the free:
> label without releasing the acquired reference, leaking it.
> 
> Fix the leak by adding an else branch that calls dma_fence_put()
> before jumping to free: for any error other than -ENOENT.
> 
> Cc: stable@vger.kernel.org

I’m going to drop the stable tag when I merge this, as in practice
dma_fence_add_callback can only return -ENOENT unless the arguments
passed are garbage. In this case, we are clearly passing valid input, or
our driver would already be exploding.

Anyway, this looks like a good change for completeness.

With that:
Reviewed-by: Matthew Brost <matthew.brost@intel.com>

Thanks for the patch.

Matt

> Fixes: 845f64bdbfc9 ("drm/xe: Introduce a range-fence utility")
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/gpu/drm/xe/xe_range_fence.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/gpu/drm/xe/xe_range_fence.c b/drivers/gpu/drm/xe/xe_range_fence.c
> index 372378e89e98..3d8fa194a7b0 100644
> --- a/drivers/gpu/drm/xe/xe_range_fence.c
> +++ b/drivers/gpu/drm/xe/xe_range_fence.c
> @@ -77,6 +77,8 @@ int xe_range_fence_insert(struct xe_range_fence_tree *tree,
>  	} else if (err == 0) {
>  		xe_range_fence_tree_insert(rfence, &tree->root);
>  		return 0;
> +	} else {
> +		dma_fence_put(fence);
>  	}
>  
>  free:
> -- 
> 2.34.1
> 

Re: [PATCH] drm/xe: fix refcount leak in xe_range_fence_insert()

[Matthew Brost]

On Mon, Jun 08, 2026 at 06:15:40AM +0000, Wentao Liang wrote:
> xe_range_fence_insert() acquires a reference on fence via
> dma_fence_get() and stores it in rfence->fence.  It then calls
> dma_fence_add_callback() and handles two cases: when the callback
> is successfully registered (err == 0) the fence is transferred to
> the tree for later cleanup; when the fence is already signaled
> (err == -ENOENT) it manually drops the extra reference with
> dma_fence_put(fence).
> 
> However, dma_fence_add_callback() can fail with other errors
> (e.g. -EINVAL) and in that case the code falls through to the free:
> label without releasing the acquired reference, leaking it.
> 
> Fix the leak by adding an else branch that calls dma_fence_put()
> before jumping to free: for any error other than -ENOENT.
> 
> Cc: stable@vger.kernel.org
> Fixes: 845f64bdbfc9 ("drm/xe: Introduce a range-fence utility")
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Merged to drm-xe-next.

Matt

> ---
>  drivers/gpu/drm/xe/xe_range_fence.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/gpu/drm/xe/xe_range_fence.c b/drivers/gpu/drm/xe/xe_range_fence.c
> index 372378e89e98..3d8fa194a7b0 100644
> --- a/drivers/gpu/drm/xe/xe_range_fence.c
> +++ b/drivers/gpu/drm/xe/xe_range_fence.c
> @@ -77,6 +77,8 @@ int xe_range_fence_insert(struct xe_range_fence_tree *tree,
>  	} else if (err == 0) {
>  		xe_range_fence_tree_insert(rfence, &tree->root);
>  		return 0;
> +	} else {
> +		dma_fence_put(fence);
>  	}
>  
>  free:
> -- 
> 2.34.1
>