[PATCH] gpu/drm/drm_syncobj: fix syncobj refcount leak on invalid flags in find_fence

[PATCH] gpu/drm/drm_syncobj: fix syncobj refcount leak on invalid flags in find_fence

[Wentao Liang]

drm_syncobj_find_fence() calls drm_syncobj_find() to obtain a
reference on syncobj, then checks the flags validity. If the flags
are invalid, it returns -EINVAL without releasing the syncobj
reference obtained earlier.

Fix this by using goto to release the reference on error paths.

Cc: stable@vger.kernel.org
Fixes: 18226ba52159 ("drm/syncobj: reject invalid flags in drm_syncobj_find_fence")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/drm_syncobj.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index 8d9fd1917c6e..0e986daa8ff9 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -442,11 +442,15 @@ int drm_syncobj_find_fence(struct drm_file *file_private,
 	u64 timeout = nsecs_to_jiffies64(DRM_SYNCOBJ_WAIT_FOR_SUBMIT_TIMEOUT);
 	int ret;
 
-	if (flags & ~DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)
-		return -EINVAL;
+	if (flags & ~DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) {
+		ret = -EINVAL;
+		goto out;
+	}
 
-	if (!syncobj)
-		return -ENOENT;
+	if (!syncobj) {
+		ret = -ENOENT;
+		goto out;
+	}
 
 	/* Waiting for userspace with locks help is illegal cause that can
 	 * trivial deadlock with page faults for example. Make lockdep complain
-- 
2.34.1

Claude review: gpu/drm/drm_syncobj: fix syncobj refcount leak on invalid flags in find_fence

[Claude Code Review Bot]

Overall Series Review

Subject: gpu/drm/drm_syncobj: fix syncobj refcount leak on invalid flags in find_fence
Author: Wentao Liang <vulab@iscas.ac.cn>
Patches: 1
Reviewed: 2026-05-25T16:51:16.005810

---

This is a single patch claiming to fix a refcount leak in `drm_syncobj_find_fence()`. **The patch is buggy — it introduces a NULL pointer dereference while attempting to fix a refcount leak, and the original code for the flags check was actually correct (no leak).**

The analysis requires looking at the order of operations in the original code vs. the patched code:

**Original code (pre-patch):**
```c
struct drm_syncobj *syncobj = drm_syncobj_find(file_private, handle);
...
if (flags & ~DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)
    return -EINVAL;

if (!syncobj)
    return -ENOENT;
```

**`out` label:**
```c
out:
    drm_syncobj_put(syncobj);
    return ret;
```

---
Generated by Claude Code Patch Reviewer

Claude review: gpu/drm/drm_syncobj: fix syncobj refcount leak on invalid flags in find_fence

[Claude Code Review Bot]

Patch Review

**The flags check (first hunk) — there IS a real refcount leak here, but the fix is wrong:**

The patch author correctly identifies that when `drm_syncobj_find()` returns a valid (non-NULL) syncobj and then the flags check fails, the original `return -EINVAL` leaks the reference. That much is a real bug.

However, the fix converts this to `goto out`, which unconditionally calls `drm_syncobj_put(syncobj)`. The problem is that `syncobj` may be NULL — `drm_syncobj_find()` can return NULL for an invalid handle. In that case, `goto out` calls `drm_syncobj_put(NULL)`, which dereferences `NULL->refcount` via `kref_put()`:

```c
static inline void
drm_syncobj_put(struct drm_syncobj *obj)
{
    kref_put(&obj->refcount, drm_syncobj_free);  // NULL deref if obj is NULL
}
```

So the flags check fix trades a refcount leak for a potential kernel NULL pointer dereference (which is worse).

**The `!syncobj` check (second hunk) — actively introduces a crash:**

The original code:
```c
if (!syncobj)
    return -ENOENT;
```

This is **correct as-is** — if `syncobj` is NULL, there is no reference to release, so returning directly is the right thing to do. The patch changes this to:

```c
if (!syncobj) {
    ret = -ENOENT;
    goto out;
}
```

This is a **clear NULL pointer dereference bug**. When `syncobj` is NULL, jumping to `out` calls `drm_syncobj_put(NULL)`, which will crash the kernel.

**Correct fix would be:**

The flags check should be moved **before** the `drm_syncobj_find()` call, or the `out` label needs to be guarded with a NULL check:

```c
out:
    if (syncobj)
        drm_syncobj_put(syncobj);
    return ret;
```

Alternatively, simply reorder the flags check to come before the `drm_syncobj_find()` call so no reference has been taken yet.

**Verdict: NAK.** The patch introduces a NULL pointer dereference that is strictly worse than the refcount leak it attempts to fix. The `!syncobj` goto is an unconditional crasher. The Cc: stable tag makes this especially concerning, as it would propagate a crashing bug into stable kernels.

---
Generated by Claude Code Patch Reviewer