Re: [PATCH] drm/gem-atomic-helper: fix fence leak on dma_fence_chain_alloc() failure

["Ville Syrjälä" <ville.syrjala@linux.intel.com>]

On Sun, Nov 08, 2026 at 12:53:03AM +0800, Chengyu Liu wrote:
> In drm_gem_plane_helper_prepare_fb(), when both "new" (the plane's GEM
> singleton fence) and "fence" (explicit or previous plane's) exist, they
> are wrapped in a freshly allocated chain.  If dma_fence_chain_alloc()
> fails, the error path runs before dma_fence_chain_init() adopts "new",
> and error: only puts "fence" - leaking one fence reference per failure.
> 
> Put "new" in the allocation-failure branch.
> 
> Found by static analysis.
> 
> Signed-off-by: Chengyu Liu <lui2012qwq@gmail.com>
> ---
>  drivers/gpu/drm/drm_gem_atomic_helper.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/gpu/drm/drm_gem_atomic_helper.c b/drivers/gpu/drm/drm_gem_atomic_helper.c
> index abef865c5f2c..1e484f26ab31 100644
> --- a/drivers/gpu/drm/drm_gem_atomic_helper.c
> +++ b/drivers/gpu/drm/drm_gem_atomic_helper.c
> @@ -153,6 +153,7 @@ 
                      ^

Why are we missing the context here? Is this some git misconfiguration
or bug?

>  		if (new && fence) {
>  			struct dma_fence_chain *chain = dma_fence_chain_alloc();
>  
>  			if (!chain) {
> +				dma_fence_put(new);
>  				ret = -ENOMEM;
>  				goto error;
>  			}
> -- 
> 2.25.1

-- 
Ville Syrjälä
Intel