Claude review: gpu/drm/drm_syncobj: fix syncobj refcount leak on invalid flags in find_fence

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**The flags check (first hunk) — there IS a real refcount leak here, but the fix is wrong:**

The patch author correctly identifies that when `drm_syncobj_find()` returns a valid (non-NULL) syncobj and then the flags check fails, the original `return -EINVAL` leaks the reference. That much is a real bug.

However, the fix converts this to `goto out`, which unconditionally calls `drm_syncobj_put(syncobj)`. The problem is that `syncobj` may be NULL — `drm_syncobj_find()` can return NULL for an invalid handle. In that case, `goto out` calls `drm_syncobj_put(NULL)`, which dereferences `NULL->refcount` via `kref_put()`:

```c
static inline void
drm_syncobj_put(struct drm_syncobj *obj)
{
    kref_put(&obj->refcount, drm_syncobj_free);  // NULL deref if obj is NULL
}
```

So the flags check fix trades a refcount leak for a potential kernel NULL pointer dereference (which is worse).

**The `!syncobj` check (second hunk) — actively introduces a crash:**

The original code:
```c
if (!syncobj)
    return -ENOENT;
```

This is **correct as-is** — if `syncobj` is NULL, there is no reference to release, so returning directly is the right thing to do. The patch changes this to:

```c
if (!syncobj) {
    ret = -ENOENT;
    goto out;
}
```

This is a **clear NULL pointer dereference bug**. When `syncobj` is NULL, jumping to `out` calls `drm_syncobj_put(NULL)`, which will crash the kernel.

**Correct fix would be:**

The flags check should be moved **before** the `drm_syncobj_find()` call, or the `out` label needs to be guarded with a NULL check:

```c
out:
    if (syncobj)
        drm_syncobj_put(syncobj);
    return ret;
```

Alternatively, simply reorder the flags check to come before the `drm_syncobj_find()` call so no reference has been taken yet.

**Verdict: NAK.** The patch introduces a NULL pointer dereference that is strictly worse than the refcount leak it attempts to fix. The `!syncobj` goto is an unconditional crasher. The Cc: stable tag makes this especially concerning, as it would propagate a crashing bug into stable kernels.

---
Generated by Claude Code Patch Reviewer