[PATCH] drm: xe: selftests: fix fence refcount leak in run_sanity_job()

[PATCH] drm: xe: selftests: fix fence refcount leak in run_sanity_job()

[Wentao Liang]

run_sanity_job() calls dma_fence_get() to take a reference on the
fence before submitting the migration job. If the job submission fails,
the function returns an error without calling dma_fence_put() on the
fence, leaking the reference.

Add dma_fence_put(fence) on the error path to properly release the
reference.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/xe/tests/xe_migrate.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/tests/xe_migrate.c b/drivers/gpu/drm/xe/tests/xe_migrate.c
index 34e2f0f4631f..36d4cff00e18 100644
--- a/drivers/gpu/drm/xe/tests/xe_migrate.c
+++ b/drivers/gpu/drm/xe/tests/xe_migrate.c
@@ -54,8 +54,10 @@ static int run_sanity_job(struct xe_migrate *m, struct xe_device *xe,
 	fence = dma_fence_get(&job->drm.s_fence->finished);
 	xe_sched_job_push(job);
 
-	if (sanity_fence_failed(xe, fence, str, test))
+	if (sanity_fence_failed(xe, fence, str, test)) {
+		dma_fence_put(fence);
 		return -ETIMEDOUT;
+	}
 
 	dma_fence_put(fence);
 	kunit_info(test, "%s: Job completed\n", str);
-- 
2.34.1

Claude review: drm: xe: selftests: fix fence refcount leak in run_sanity_job()

[Claude Code Review Bot]

Patch Review

**Correctness: The code change is correct.**

The flow is:
1. Line 55: `fence = dma_fence_get(&job->drm.s_fence->finished);` — takes a reference
2. Line 56: `xe_sched_job_push(job);` — submits the job (job ownership transferred to scheduler)
3. Line 58: `sanity_fence_failed()` checks if the fence completed; if it failed, the original code returned without releasing the fence reference

The added `dma_fence_put(fence)` on the error path correctly balances the `dma_fence_get()`.

**Minor note on the commit message:** The commit message says "If the job submission fails, the function returns an error without calling dma_fence_put()". This is slightly misleading — the job submission (`xe_sched_job_push`) itself doesn't fail here. What happens is the fence *times out* (or is an error/NULL), and `sanity_fence_failed()` returns true. The leak occurs on the fence-wait failure path, not the job-submission failure path. The distinction matters because `xe_sched_job_push()` is a void function that always succeeds — the job is already pushed before the fence check.

**Fixes tag concern:** The `Fixes:` tag points to `dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")` which is the initial xe driver commit. While technically the buggy code was introduced there, this is a very broad Fixes tag. A more precise tag would reference whatever commit introduced or last modified `run_sanity_job()` into its current form. This matters because the `Cc: stable@vger.kernel.org` tag means this will be considered for backporting — using the initial driver commit as the Fixes tag could cause confusion about which stable branches need the fix.

**Stable backport concern:** This is a KUnit selftest fix — not a production code path. Tagging it `Cc: stable@vger.kernel.org` is questionable since the leak only occurs in test code during a fence timeout/failure scenario. Test-only fixes are generally not backported to stable kernels.

**Verdict:** The code change itself is correct and trivially safe. The metadata (commit message accuracy, Fixes tag precision, stable tag appropriateness) could be improved.

---
Generated by Claude Code Patch Reviewer

Claude review: drm: xe: selftests: fix fence refcount leak in run_sanity_job()

[Claude Code Review Bot]

Overall Series Review

Subject: drm: xe: selftests: fix fence refcount leak in run_sanity_job()
Author: Wentao Liang <vulab@iscas.ac.cn>
Patches: 1
Reviewed: 2026-05-28T12:37:36.567576

---

This is a single-patch series claiming to fix a `dma_fence` refcount leak in `run_sanity_job()` in the xe driver's KUnit selftests. **The fix is correct and valid.** The function takes a reference via `dma_fence_get()` at line 55, then on the error path where `sanity_fence_failed()` returns true, the original code returned `-ETIMEDOUT` without calling `dma_fence_put()`, leaking the reference. The patch adds `dma_fence_put(fence)` before the early return, matching the `dma_fence_put(fence)` that already exists on the success path at line 63.

However, there are issues with the commit metadata.

---
Generated by Claude Code Patch Reviewer