From mboxrd@z Thu Jan  1 00:00:00 1970
From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: gpu/drm/drm_syncobj: fix syncobj refcount leak on invalid flags in find_fence
Date: Mon, 25 May 2026 16:51:16 +1000
Message-ID: <review-overall-20260525023324.3883862-1-vulab@iscas.ac.cn>
In-Reply-To: <20260525023324.3883862-1-vulab@iscas.ac.cn>
References: <20260525023324.3883862-1-vulab@iscas.ac.cn>
X-Mailer: Claude Code Patch Reviewer
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Overall Series Review

Subject: gpu/drm/drm_syncobj: fix syncobj refcount leak on invalid flags in=
 find_fence
Author: Wentao Liang <vulab@iscas.ac.cn>
Patches: 1
Reviewed: 2026-05-25T16:51:16.005810

---

This is a single patch claiming to fix a refcount leak in `drm_syncobj_find=
_fence()`. **The patch is buggy =E2=80=94 it introduces a NULL pointer dere=
ference while attempting to fix a refcount leak, and the original code for =
the flags check was actually correct (no leak).**

The analysis requires looking at the order of operations in the original co=
de vs. the patched code:

**Original code (pre-patch):**
```c
struct drm_syncobj *syncobj =3D drm_syncobj_find(file_private, handle);
...
if (flags & ~DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)
    return -EINVAL;

if (!syncobj)
    return -ENOENT;
```

**`out` label:**
```c
out:
    drm_syncobj_put(syncobj);
    return ret;
```

---
Generated by Claude Code Patch Reviewer