[PATCH] drm/gem-atomic-helper: fix fence leak on dma_fence_chain_alloc() failure

[PATCH] drm/gem-atomic-helper: fix fence leak on dma_fence_chain_alloc() failure

[Chengyu Liu]

In drm_gem_plane_helper_prepare_fb(), when both "new" (the plane's GEM
singleton fence) and "fence" (explicit or previous plane's) exist, they
are wrapped in a freshly allocated chain.  If dma_fence_chain_alloc()
fails, the error path runs before dma_fence_chain_init() adopts "new",
and error: only puts "fence" - leaking one fence reference per failure.

Put "new" in the allocation-failure branch.

Found by static analysis.

Signed-off-by: Chengyu Liu <lui2012qwq@gmail.com>
---
 drivers/gpu/drm/drm_gem_atomic_helper.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/drm_gem_atomic_helper.c b/drivers/gpu/drm/drm_gem_atomic_helper.c
index abef865c5f2c..1e484f26ab31 100644
--- a/drivers/gpu/drm/drm_gem_atomic_helper.c
+++ b/drivers/gpu/drm/drm_gem_atomic_helper.c
@@ -153,6 +153,7 @@
 		if (new && fence) {
 			struct dma_fence_chain *chain = dma_fence_chain_alloc();
 
 			if (!chain) {
+				dma_fence_put(new);
 				ret = -ENOMEM;
 				goto error;
 			}
-- 
2.25.1

Re: [PATCH] drm/gem-atomic-helper: fix fence leak on dma_fence_chain_alloc() failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] drm/gem-atomic-helper: missing Fixes trailer for commit
  1ea28bc5542d
--

commit b6d9ff23bfcc702d784107d5026972257646c1fc
Author: Chengyu Liu <lui2012qwq@gmail.com>

> drm/gem-atomic-helper: fix fence leak on dma_fence_chain_alloc() failure
>
> In drm_gem_plane_helper_prepare_fb(), when both "new" (the plane's GEM
> singleton fence) and "fence" (explicit or previous plane's) exist, they
> are wrapped in a freshly allocated chain.  If dma_fence_chain_alloc()
> fails, the error path runs before dma_fence_chain_init() adopts "new",
> and error: only puts "fence" - leaking one fence reference per failure.
>
> Put "new" in the allocation-failure branch.
>
> Found by static analysis.
>
> Signed-off-by: Chengyu Liu <lui2012qwq@gmail.com>

[Severity: Low]
Should this commit include a Fixes: tag for the commit that introduced the
leak:

  Fixes: 1ea28bc5542d ("drm: handle kernel fences in drm_gem_plane_helper_prepare_fb v2")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107165303.13508-1-lui2012qwq@gmail.com?part=1

Re: [PATCH] drm/gem-atomic-helper: fix fence leak on dma_fence_chain_alloc() failure

[Chengyu Liu]

On Mon, Nov 9, 2026 at 5:50 PM <sashiko-bot@kernel.org> wrote:
> [Severity: Low]
> Should this commit include a Fixes: tag for the commit that introduced the
> leak:
>
>   Fixes: 1ea28bc5542d ("drm: handle kernel fences in drm_gem_plane_helper_prepare_fb v2")

Thanks, v2 will include the fix tag.

On Mon, Nov 9, 2026 at 5:50 PM <sashiko-bot@kernel.org> wrote:
>
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue to consider:
> - [Low] drm/gem-atomic-helper: missing Fixes trailer for commit
>   1ea28bc5542d
> --
>
> commit b6d9ff23bfcc702d784107d5026972257646c1fc
> Author: Chengyu Liu <lui2012qwq@gmail.com>
>
> > drm/gem-atomic-helper: fix fence leak on dma_fence_chain_alloc() failure
> >
> > In drm_gem_plane_helper_prepare_fb(), when both "new" (the plane's GEM
> > singleton fence) and "fence" (explicit or previous plane's) exist, they
> > are wrapped in a freshly allocated chain.  If dma_fence_chain_alloc()
> > fails, the error path runs before dma_fence_chain_init() adopts "new",
> > and error: only puts "fence" - leaking one fence reference per failure.
> >
> > Put "new" in the allocation-failure branch.
> >
> > Found by static analysis.
> >
> > Signed-off-by: Chengyu Liu <lui2012qwq@gmail.com>
>
> [Severity: Low]
> Should this commit include a Fixes: tag for the commit that introduced the
> leak:
>
>   Fixes: 1ea28bc5542d ("drm: handle kernel fences in drm_gem_plane_helper_prepare_fb v2")
>
> --
> Sashiko AI review · https://sashiko.dev/#/patchset/20261107165303.13508-1-lui2012qwq@gmail.com?part=1

Re: [PATCH] drm/gem-atomic-helper: fix fence leak on dma_fence_chain_alloc() failure

[Ville Syrjälä]

On Sun, Nov 08, 2026 at 12:53:03AM +0800, Chengyu Liu wrote:
> In drm_gem_plane_helper_prepare_fb(), when both "new" (the plane's GEM
> singleton fence) and "fence" (explicit or previous plane's) exist, they
> are wrapped in a freshly allocated chain.  If dma_fence_chain_alloc()
> fails, the error path runs before dma_fence_chain_init() adopts "new",
> and error: only puts "fence" - leaking one fence reference per failure.
> 
> Put "new" in the allocation-failure branch.
> 
> Found by static analysis.
> 
> Signed-off-by: Chengyu Liu <lui2012qwq@gmail.com>
> ---
>  drivers/gpu/drm/drm_gem_atomic_helper.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/gpu/drm/drm_gem_atomic_helper.c b/drivers/gpu/drm/drm_gem_atomic_helper.c
> index abef865c5f2c..1e484f26ab31 100644
> --- a/drivers/gpu/drm/drm_gem_atomic_helper.c
> +++ b/drivers/gpu/drm/drm_gem_atomic_helper.c
> @@ -153,6 +153,7 @@ 
                      ^

Why are we missing the context here? Is this some git misconfiguration
or bug?

>  		if (new && fence) {
>  			struct dma_fence_chain *chain = dma_fence_chain_alloc();
>  
>  			if (!chain) {
> +				dma_fence_put(new);
>  				ret = -ENOMEM;
>  				goto error;
>  			}
> -- 
> 2.25.1

-- 
Ville Syrjälä
Intel

Re: [PATCH] drm/gem-atomic-helper: fix fence leak on dma_fence_chain_alloc() failure

[Chengyu Liu]

On Fri, Nov 13, 2026 at 10:04 PM Ville Syrjälä
<ville.syrjala@linux.intel.com> wrote:
> > diff --git a/drivers/gpu/drm/drm_gem_atomic_helper.c b/drivers/gpu/drm/drm_gem_atomic_helper.c
> > index abef865c5f2c..1e484f26ab31 100644
> > --- a/drivers/gpu/drm/drm_gem_atomic_helper.c
> > +++ b/drivers/gpu/drm/drm_gem_atomic_helper.c
> > @@ -153,6 +153,7 @@
>                       ^
>
> Why are we missing the context here? Is this some git misconfiguration
> or bug?

My mistake, not a Git problem.

I assembled the patch outside the kernel Git tree instead of
generating it from a commit with git format-patch, so the hunk headers
were missing the function context. Since v2 was based on v1, it
inherited the same issue.

git apply and checkpatch.pl accept the patch without this context,
which is how I missed it.

v3 contains the same fix, regenerated from a commit in the kernel tree
using git format-patch. The hunk headers now include the proper
function context.

Sorry for the noise.