[PATCH] gpu/drm/drm_syncobj: fix fence and syncobj refcount leak in drm_syncobj_import_sync_file_fence()

[PATCH] gpu/drm/drm_syncobj: fix fence and syncobj refcount leak in drm_syncobj_import_sync_file_fence()

[Wentao Liang]

In drm_syncobj_import_sync_file_fence(), when point is non-zero and
dma_fence_chain_alloc() fails, the function returns -ENOMEM without
releasing the fence reference (obtained via sync_file_get_fence)
and the syncobj reference (obtained via drm_syncobj_find).

Add dma_fence_put() and drm_syncobj_put() calls on the error path
to properly release both references.

Cc: stable@vger.kernel.org
Fixes: c2d3a7300695 ("drm/syncobj: Extend EXPORT_SYNC_FILE for timeline syncobjs")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/drm_syncobj.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index 0e986daa8ff9..34c87698e316 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -745,8 +745,11 @@ static int drm_syncobj_import_sync_file_fence(struct drm_file *file_private,
 	if (point) {
 		struct dma_fence_chain *chain = dma_fence_chain_alloc();
 
-		if (!chain)
+		if (!chain) {
+			dma_fence_put(fence);
+			drm_syncobj_put(syncobj);
 			return -ENOMEM;
+		}
 
 		drm_syncobj_add_point(syncobj, chain, fence, point);
 	} else {
-- 
2.34.1

Claude review: gpu/drm/drm_syncobj: fix fence and syncobj refcount leak in drm_syncobj_import_sync_file_fence()

[Claude Code Review Bot]

Overall Series Review

Subject: gpu/drm/drm_syncobj: fix fence and syncobj refcount leak in drm_syncobj_import_sync_file_fence()
Author: Wentao Liang <vulab@iscas.ac.cn>
Patches: 1
Reviewed: 2026-05-25T16:49:32.435535

---

This is a single-patch series fixing a real refcount leak bug in `drm_syncobj_import_sync_file_fence()`. The analysis is correct: when `point` is non-zero and `dma_fence_chain_alloc()` fails, the original code returned `-ENOMEM` without releasing the `fence` reference (from `sync_file_get_fence()` on line 729) or the `syncobj` reference (from `drm_syncobj_find()` on line 735). The fix is straightforward and follows the existing cleanup pattern already used elsewhere in the function.

**Verdict: The patch is correct and should be accepted.**

---
Generated by Claude Code Patch Reviewer

Claude review: gpu/drm/drm_syncobj: fix fence and syncobj refcount leak in drm_syncobj_import_sync_file_fence()

[Claude Code Review Bot]

Patch Review

**Bug analysis:** Correct. Looking at the function:

1. `fence` is obtained at line 729 via `sync_file_get_fence(fd)` — this takes a reference.
2. `syncobj` is obtained at line 735 via `drm_syncobj_find(file_private, handle)` — this takes a reference.
3. The existing error path for `!syncobj` at line 736-738 correctly calls `dma_fence_put(fence)` before returning.
4. The normal exit path at lines 755-757 correctly calls both `dma_fence_put(fence)` and `drm_syncobj_put(syncobj)`.
5. **Pre-patch**, the `!chain` error path at line 744 returned `-ENOMEM` without releasing either reference — a genuine leak.

**Fix correctness:** The added cleanup calls:
```c
if (!chain) {
    dma_fence_put(fence);
    drm_syncobj_put(syncobj);
    return -ENOMEM;
}
```
are correct and mirror the cleanup at the end of the function (lines 755-757). The order (`fence` then `syncobj`) is consistent with the existing `!syncobj` error path pattern.

**Fixes tag:** Points to `c2d3a7300695 ("drm/syncobj: Extend EXPORT_SYNC_FILE for timeline syncobjs")` which introduced the `point` / `dma_fence_chain_alloc` path. This is the correct commit to reference.

**Cc: stable:** Appropriate — this is a resource leak fix with a clear Fixes tag.

**Minor style note:** The commit subject uses the full path `gpu/drm/drm_syncobj` rather than the conventional `drm/syncobj` subsystem prefix used in the Fixes tag and by most DRM commits. This is cosmetic only but worth noting for the maintainer to adjust when applying.

**No issues found with the patch logic.** Clean, minimal, correct fix.

---
Generated by Claude Code Patch Reviewer