From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c:664 amdgpu_userq_wait_count_fences() warn: passing freed memory 'fence' (line 652)
Date: Fri, 03 Jul 2026 07:49:43 +0800 [thread overview]
Message-ID: <202607030723.dZmHjLbL-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: "Christian König" <christian.koenig@amd.com>
CC: Alex Deucher <alexander.deucher@amd.com>
CC: Sunil Khatri <sunil.khatri@amd.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 87320be9f0d24fce67631b7eef919f0b79c3e45c
commit: a1371d9f0e611ef40cd31b02565e2325701c1d82 drm/amdgpu: rework amdgpu_userq_wait_ioctl v4
date: 4 months ago
:::::: branch date: 8 hours ago
:::::: commit date: 4 months ago
config: sparc-randconfig-r071-20260702 (https://download.01.org/0day-ci/archive/20260703/202607030723.dZmHjLbL-lkp@intel.com/config)
compiler: sparc64-linux-gcc (GCC) 13.4.0
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: a1371d9f0e61 ("drm/amdgpu: rework amdgpu_userq_wait_ioctl v4")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202607030723.dZmHjLbL-lkp@intel.com/
New smatch warnings:
drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c:664 amdgpu_userq_wait_count_fences() warn: passing freed memory 'fence' (line 652)
Old smatch warnings:
drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c:599 amdgpu_userq_signal_ioctl() error: we previously assumed 'gobj_write' could be null (see line 581)
drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c:603 amdgpu_userq_signal_ioctl() error: we previously assumed 'gobj_read' could be null (see line 573)
vim +/fence +664 drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 618
a1371d9f0e611e Christian König 2026-01-29 619 /* Count the number of expected fences so userspace can alloc a buffer */
a1371d9f0e611e Christian König 2026-01-29 620 static int
a1371d9f0e611e Christian König 2026-01-29 621 amdgpu_userq_wait_count_fences(struct drm_file *filp,
a1371d9f0e611e Christian König 2026-01-29 622 struct drm_amdgpu_userq_wait *wait_info,
a1371d9f0e611e Christian König 2026-01-29 623 u32 *syncobj_handles, u32 *timeline_points,
a1371d9f0e611e Christian König 2026-01-29 624 u32 *timeline_handles,
a1371d9f0e611e Christian König 2026-01-29 625 struct drm_gem_object **gobj_write,
a1371d9f0e611e Christian König 2026-01-29 626 struct drm_gem_object **gobj_read)
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 627 {
a1371d9f0e611e Christian König 2026-01-29 628 int num_read_bo_handles, num_write_bo_handles;
a1371d9f0e611e Christian König 2026-01-29 629 struct dma_fence_unwrap iter;
a1371d9f0e611e Christian König 2026-01-29 630 struct dma_fence *fence, *f;
a1371d9f0e611e Christian König 2026-01-29 631 unsigned int num_fences = 0;
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 632 struct drm_exec exec;
a1371d9f0e611e Christian König 2026-01-29 633 int i, r;
cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 634
a1371d9f0e611e Christian König 2026-01-29 635 /*
a1371d9f0e611e Christian König 2026-01-29 636 * This needs to be outside of the lock provided by drm_exec for
a1371d9f0e611e Christian König 2026-01-29 637 * DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT to work correctly.
a1371d9f0e611e Christian König 2026-01-29 638 */
15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 639
a1371d9f0e611e Christian König 2026-01-29 640 /* Count timeline fences */
a1371d9f0e611e Christian König 2026-01-29 641 for (i = 0; i < wait_info->num_syncobj_timeline_handles; i++) {
15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 642 r = drm_syncobj_find_fence(filp, timeline_handles[i],
15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 643 timeline_points[i],
15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 644 DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT,
15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 645 &fence);
15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 646 if (r)
a1371d9f0e611e Christian König 2026-01-29 647 return r;
15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 648
15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 649 dma_fence_unwrap_for_each(f, &iter, fence)
15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 650 num_fences++;
15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 651
15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 @652 dma_fence_put(fence);
15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 653 }
15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 654
a1371d9f0e611e Christian König 2026-01-29 655 /* Count boolean fences */
a1371d9f0e611e Christian König 2026-01-29 656 for (i = 0; i < wait_info->num_syncobj_handles; i++) {
a1371d9f0e611e Christian König 2026-01-29 657 r = drm_syncobj_find_fence(filp, syncobj_handles[i], 0,
15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 658 DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT,
15e30a6e479282 Arunpravin Paneer Selvam 2024-10-30 659 &fence);
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 660 if (r)
a1371d9f0e611e Christian König 2026-01-29 661 return r;
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 662
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 663 num_fences++;
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 @664 dma_fence_put(fence);
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 665 }
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 666
a1371d9f0e611e Christian König 2026-01-29 667 /* Lock all the GEM objects */
a1371d9f0e611e Christian König 2026-01-29 668 /* TODO: It is actually not necessary to lock them */
a1371d9f0e611e Christian König 2026-01-29 669 num_read_bo_handles = wait_info->num_bo_read_handles;
a1371d9f0e611e Christian König 2026-01-29 670 num_write_bo_handles = wait_info->num_bo_write_handles;
a1371d9f0e611e Christian König 2026-01-29 671 drm_exec_init(&exec, DRM_EXEC_INTERRUPTIBLE_WAIT,
a1371d9f0e611e Christian König 2026-01-29 672 num_read_bo_handles + num_write_bo_handles);
a1371d9f0e611e Christian König 2026-01-29 673
a1371d9f0e611e Christian König 2026-01-29 674 drm_exec_until_all_locked(&exec) {
a1371d9f0e611e Christian König 2026-01-29 675 r = drm_exec_prepare_array(&exec, gobj_read,
a1371d9f0e611e Christian König 2026-01-29 676 num_read_bo_handles, 1);
a1371d9f0e611e Christian König 2026-01-29 677 drm_exec_retry_on_contention(&exec);
a1371d9f0e611e Christian König 2026-01-29 678 if (r)
a1371d9f0e611e Christian König 2026-01-29 679 goto error_unlock;
a1371d9f0e611e Christian König 2026-01-29 680
a1371d9f0e611e Christian König 2026-01-29 681 r = drm_exec_prepare_array(&exec, gobj_write,
a1371d9f0e611e Christian König 2026-01-29 682 num_write_bo_handles, 1);
a1371d9f0e611e Christian König 2026-01-29 683 drm_exec_retry_on_contention(&exec);
a1371d9f0e611e Christian König 2026-01-29 684 if (r)
a1371d9f0e611e Christian König 2026-01-29 685 goto error_unlock;
a1371d9f0e611e Christian König 2026-01-29 686 }
a1371d9f0e611e Christian König 2026-01-29 687
a1371d9f0e611e Christian König 2026-01-29 688 /* Count read fences */
cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 689 for (i = 0; i < num_read_bo_handles; i++) {
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 690 struct dma_resv_iter resv_cursor;
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 691 struct dma_fence *fence;
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 692
cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 693 dma_resv_for_each_fence(&resv_cursor, gobj_read[i]->resv,
cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 694 DMA_RESV_USAGE_READ, fence)
cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 695 num_fences++;
cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 696 }
cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 697
a1371d9f0e611e Christian König 2026-01-29 698 /* Count write fences */
cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 699 for (i = 0; i < num_write_bo_handles; i++) {
cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 700 struct dma_resv_iter resv_cursor;
cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 701 struct dma_fence *fence;
cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 702
cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 703 dma_resv_for_each_fence(&resv_cursor, gobj_write[i]->resv,
cb4a73f46f253b Arunpravin Paneer Selvam 2024-10-30 704 DMA_RESV_USAGE_WRITE, fence)
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 705 num_fences++;
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 706 }
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 707
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 708 wait_info->num_fences = num_fences;
a1371d9f0e611e Christian König 2026-01-29 709 r = 0;
a1371d9f0e611e Christian König 2026-01-29 710
a1371d9f0e611e Christian König 2026-01-29 711 error_unlock:
a1371d9f0e611e Christian König 2026-01-29 712 /* Unlock all the GEM objects */
a1371d9f0e611e Christian König 2026-01-29 713 drm_exec_fini(&exec);
a1371d9f0e611e Christian König 2026-01-29 714 return r;
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 715 }
a292fdecd72834 Arunpravin Paneer Selvam 2024-10-30 716
:::::: The code at line 664 was first introduced by commit
:::::: a292fdecd72834b3bec380baa5db1e69e7f70679 drm/amdgpu: Implement userqueue signal/wait IOCTL
:::::: TO: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
:::::: CC: Alex Deucher <alexander.deucher@amd.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-07-02 23:50 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202607030723.dZmHjLbL-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox