[PATCH] drm/gem: Remove unneeded ret check in change handle ioctl

[PATCH] drm/gem: Remove unneeded ret check in change handle ioctl

[Jonathan Cavitt]

Remove the "if (ret < 0)" branch after idr_replace in
drm_gem_change_handle_ioctl.  It is unused, as in the only place we
modify the return value between there and the previous return value
check, we also immediately jump to out_unlock, bypassing the check
entirely.

Issue caught by static analysis.

Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@gmail.com>
Cc: Simona Vetter <simona@ffwll.ch>
---
 drivers/gpu/drm/drm_gem.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index abc8e41d6652..110bc5a58862 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -1067,9 +1067,6 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data,
 
 	spin_unlock(&file_priv->table_lock);
 
-	if (ret < 0)
-		goto out_unlock;
-
 	if (obj->dma_buf) {
 		ret = drm_prime_add_buf_handle(&file_priv->prime, obj->dma_buf,
 					       handle);
-- 
2.53.0

Re: [PATCH] drm/gem: Remove unneeded ret check in change handle ioctl

[Rodrigo Vivi]

On Mon, May 11, 2026 at 10:25:40PM +0800, Jonathan Cavitt wrote:
> Remove the "if (ret < 0)" branch after idr_replace in
> drm_gem_change_handle_ioctl.  It is unused, as in the only place we
> modify the return value between there and the previous return value
> check, we also immediately jump to out_unlock, bypassing the check
> entirely.
> 
> Issue caught by static analysis.

Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

> 
> Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> Cc: Maxime Ripard <mripard@kernel.org>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: David Airlie <airlied@gmail.com>
> Cc: Simona Vetter <simona@ffwll.ch>
> ---
>  drivers/gpu/drm/drm_gem.c | 3 ---
>  1 file changed, 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
> index abc8e41d6652..110bc5a58862 100644
> --- a/drivers/gpu/drm/drm_gem.c
> +++ b/drivers/gpu/drm/drm_gem.c
> @@ -1067,9 +1067,6 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data,
>  
>  	spin_unlock(&file_priv->table_lock);
>  
> -	if (ret < 0)
> -		goto out_unlock;
> -
>  	if (obj->dma_buf) {
>  		ret = drm_prime_add_buf_handle(&file_priv->prime, obj->dma_buf,
>  					       handle);
> -- 
> 2.53.0
> 

Re: [PATCH] drm/gem: Remove unneeded ret check in change handle ioctl

[Rodrigo Vivi]

On Thu, May 14, 2026 at 11:16:21AM -0400, Rodrigo Vivi wrote:
> On Mon, May 11, 2026 at 10:25:40PM +0800, Jonathan Cavitt wrote:
> > Remove the "if (ret < 0)" branch after idr_replace in
> > drm_gem_change_handle_ioctl.  It is unused, as in the only place we
> > modify the return value between there and the previous return value
> > check, we also immediately jump to out_unlock, bypassing the check
> > entirely.
> > 
> > Issue caught by static analysis.
> 
> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

It doesn't apply in drm-misc branches yet because it doesn't yet
have the culprit patch that caused this code.

That is only part of drm-fixes:

5e28b7b94408 ("drm: Set old handle to NULL before prime swap in change_handle")

I believe this patch here can wait this culprit patch to get propagated
through a backmerge/rebase...

> 
> > 
> > Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
> > Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> > Cc: Maxime Ripard <mripard@kernel.org>
> > Cc: Thomas Zimmermann <tzimmermann@suse.de>
> > Cc: David Airlie <airlied@gmail.com>
> > Cc: Simona Vetter <simona@ffwll.ch>
> > ---
> >  drivers/gpu/drm/drm_gem.c | 3 ---
> >  1 file changed, 3 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
> > index abc8e41d6652..110bc5a58862 100644
> > --- a/drivers/gpu/drm/drm_gem.c
> > +++ b/drivers/gpu/drm/drm_gem.c
> > @@ -1067,9 +1067,6 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data,
> >  
> >  	spin_unlock(&file_priv->table_lock);
> >  
> > -	if (ret < 0)
> > -		goto out_unlock;
> > -
> >  	if (obj->dma_buf) {
> >  		ret = drm_prime_add_buf_handle(&file_priv->prime, obj->dma_buf,
> >  					       handle);
> > -- 
> > 2.53.0
> > 

Claude review: drm/gem: Remove unneeded ret check in change handle ioctl

[Claude Code Review Bot]

Overall Series Review

Subject: drm/gem: Remove unneeded ret check in change handle ioctl
Author: Jonathan Cavitt <jonathan.cavitt@intel.com>
Patches: 3
Reviewed: 2026-05-16T15:11:29.210502

---

This is a single-patch series that attempts to remove what it claims is a dead `if (ret < 0)` check after `idr_replace` in `drm_gem_change_handle_ioctl`. However, **the patch is based on an older version of the code that has since been refactored**. The current drm-next tree no longer uses `idr_replace` in this function — it was reworked to use `idr_alloc` + `idr_remove`. The patch does not apply cleanly, and the issue it addresses no longer exists in the current code.

**Recommendation: NAK / Obsolete** — the code the patch targets has already been restructured, making this change moot.

---
Generated by Claude Code Patch Reviewer

Claude review: drm/gem: Remove unneeded ret check in change handle ioctl

[Claude Code Review Bot]

Patch Review

**Base mismatch — patch is obsolete.**

The patch removes these lines (from its base revision `abc8e41d6652`):

```c
	spin_unlock(&file_priv->table_lock);

-	if (ret < 0)
-		goto out_unlock;
-
	if (obj->dma_buf) {
```

The commit message states this `if (ret < 0)` check after `idr_replace` is dead code because "in the only place we modify the return value between there and the previous return value check, we also immediately jump to out_unlock, bypassing the check entirely." For an `idr_replace`-based implementation, this analysis is likely correct — `idr_replace` returns `void *` (not `int`), so any error from it would be caught via `IS_ERR()` and would immediately `goto out_unlock`, meaning `ret` is never set to a negative value in a path that falls through to this check.

**However, the current drm-next code at `drivers/gpu/drm/drm_gem.c:1044-1050` has been rewritten:**

```c
	spin_lock(&file_priv->table_lock);
	ret = idr_alloc(&file_priv->object_idr, obj, handle, handle + 1,
			GFP_NOWAIT);
	spin_unlock(&file_priv->table_lock);

	if (ret < 0)
		goto out_unlock;
```

In the current code, `ret` is set directly by `idr_alloc()`, which returns a negative errno on failure (e.g., `-ENOSPC` if the handle is already in use, `-ENOMEM`). The `if (ret < 0)` check is **not dead code** — it is essential for error handling. Removing it in the current code would cause the function to proceed with a failed allocation, leading to incorrect behavior.

**Issues:**
1. The patch does not apply — the pre-image hash `abc8e41d6652` does not match the current drm-next tree.
2. The commit message references `idr_replace`, but drm-next uses `idr_alloc` — the function has been refactored since the patch was written.
3. Naively adapting this patch to the current code would introduce a bug by removing a necessary error check on `idr_alloc`'s return value.

**Verdict:** The underlying dead-code observation was probably valid for the `idr_replace` version, but the code has moved on. This patch should be dropped. If the author rebases onto drm-next, they will find the `idr_replace` call is gone and the analogous `ret` check is no longer dead.

---
Generated by Claude Code Patch Reviewer