[PATCH] drm/gem-atomic-helper: fix fence leak on dma_fence_chain_alloc() failure

[PATCH] drm/gem-atomic-helper: fix fence leak on dma_fence_chain_alloc() failure

[Chengyu Liu]

In drm_gem_plane_helper_prepare_fb(), when both "new" (the plane's GEM
singleton fence) and "fence" (explicit or previous plane's) exist, they
are wrapped in a freshly allocated chain.  If dma_fence_chain_alloc()
fails, the error path runs before dma_fence_chain_init() adopts "new",
and error: only puts "fence" - leaking one fence reference per failure.

Put "new" in the allocation-failure branch.

Found by static analysis.

Signed-off-by: Chengyu Liu <lui2012qwq@gmail.com>
---
 drivers/gpu/drm/drm_gem_atomic_helper.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/drm_gem_atomic_helper.c b/drivers/gpu/drm/drm_gem_atomic_helper.c
index abef865c5f2c..1e484f26ab31 100644
--- a/drivers/gpu/drm/drm_gem_atomic_helper.c
+++ b/drivers/gpu/drm/drm_gem_atomic_helper.c
@@ -153,6 +153,7 @@
 		if (new && fence) {
 			struct dma_fence_chain *chain = dma_fence_chain_alloc();
 
 			if (!chain) {
+				dma_fence_put(new);
 				ret = -ENOMEM;
 				goto error;
 			}
-- 
2.25.1

Re: [PATCH] drm/gem-atomic-helper: fix fence leak on dma_fence_chain_alloc() failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] drm/gem-atomic-helper: missing Fixes trailer for commit
  1ea28bc5542d
--

commit b6d9ff23bfcc702d784107d5026972257646c1fc
Author: Chengyu Liu <lui2012qwq@gmail.com>

> drm/gem-atomic-helper: fix fence leak on dma_fence_chain_alloc() failure
>
> In drm_gem_plane_helper_prepare_fb(), when both "new" (the plane's GEM
> singleton fence) and "fence" (explicit or previous plane's) exist, they
> are wrapped in a freshly allocated chain.  If dma_fence_chain_alloc()
> fails, the error path runs before dma_fence_chain_init() adopts "new",
> and error: only puts "fence" - leaking one fence reference per failure.
>
> Put "new" in the allocation-failure branch.
>
> Found by static analysis.
>
> Signed-off-by: Chengyu Liu <lui2012qwq@gmail.com>

[Severity: Low]
Should this commit include a Fixes: tag for the commit that introduced the
leak:

  Fixes: 1ea28bc5542d ("drm: handle kernel fences in drm_gem_plane_helper_prepare_fb v2")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107165303.13508-1-lui2012qwq@gmail.com?part=1

Re: [PATCH] drm/gem-atomic-helper: fix fence leak on dma_fence_chain_alloc() failure

[Chengyu Liu]

On Mon, Nov 9, 2026 at 5:50 PM <sashiko-bot@kernel.org> wrote:
> [Severity: Low]
> Should this commit include a Fixes: tag for the commit that introduced the
> leak:
>
>   Fixes: 1ea28bc5542d ("drm: handle kernel fences in drm_gem_plane_helper_prepare_fb v2")

Thanks, v2 will include the fix tag.

On Mon, Nov 9, 2026 at 5:50 PM <sashiko-bot@kernel.org> wrote:
>
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue to consider:
> - [Low] drm/gem-atomic-helper: missing Fixes trailer for commit
>   1ea28bc5542d
> --
>
> commit b6d9ff23bfcc702d784107d5026972257646c1fc
> Author: Chengyu Liu <lui2012qwq@gmail.com>
>
> > drm/gem-atomic-helper: fix fence leak on dma_fence_chain_alloc() failure
> >
> > In drm_gem_plane_helper_prepare_fb(), when both "new" (the plane's GEM
> > singleton fence) and "fence" (explicit or previous plane's) exist, they
> > are wrapped in a freshly allocated chain.  If dma_fence_chain_alloc()
> > fails, the error path runs before dma_fence_chain_init() adopts "new",
> > and error: only puts "fence" - leaking one fence reference per failure.
> >
> > Put "new" in the allocation-failure branch.
> >
> > Found by static analysis.
> >
> > Signed-off-by: Chengyu Liu <lui2012qwq@gmail.com>
>
> [Severity: Low]
> Should this commit include a Fixes: tag for the commit that introduced the
> leak:
>
>   Fixes: 1ea28bc5542d ("drm: handle kernel fences in drm_gem_plane_helper_prepare_fb v2")
>
> --
> Sashiko AI review · https://sashiko.dev/#/patchset/20261107165303.13508-1-lui2012qwq@gmail.com?part=1