From mboxrd@z Thu Jan  1 00:00:00 1970
From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: gpu/drm/drm_syncobj: fix fence and syncobj refcount leak in drm_syncobj_import_sync_file_fence()
Date: Mon, 25 May 2026 16:49:32 +1000
Message-ID: <review-patch1-20260525025455.3887523-1-vulab@iscas.ac.cn>
In-Reply-To: <20260525025455.3887523-1-vulab@iscas.ac.cn>
References: <20260525025455.3887523-1-vulab@iscas.ac.cn> <20260525025455.3887523-1-vulab@iscas.ac.cn>
X-Mailer: Claude Code Patch Reviewer
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Patch Review

**Bug analysis:** Correct. Looking at the function:

1. `fence` is obtained at line 729 via `sync_file_get_fence(fd)` =E2=80=94 =
this takes a reference.
2. `syncobj` is obtained at line 735 via `drm_syncobj_find(file_private, ha=
ndle)` =E2=80=94 this takes a reference.
3. The existing error path for `!syncobj` at line 736-738 correctly calls `=
dma_fence_put(fence)` before returning.
4. The normal exit path at lines 755-757 correctly calls both `dma_fence_pu=
t(fence)` and `drm_syncobj_put(syncobj)`.
5. **Pre-patch**, the `!chain` error path at line 744 returned `-ENOMEM` wi=
thout releasing either reference =E2=80=94 a genuine leak.

**Fix correctness:** The added cleanup calls:
```c
if (!chain) {
    dma_fence_put(fence);
    drm_syncobj_put(syncobj);
    return -ENOMEM;
}
```
are correct and mirror the cleanup at the end of the function (lines 755-75=
7). The order (`fence` then `syncobj`) is consistent with the existing `!sy=
ncobj` error path pattern.

**Fixes tag:** Points to `c2d3a7300695 ("drm/syncobj: Extend EXPORT_SYNC_FI=
LE for timeline syncobjs")` which introduced the `point` / `dma_fence_chain=
_alloc` path. This is the correct commit to reference.

**Cc: stable:** Appropriate =E2=80=94 this is a resource leak fix with a cl=
ear Fixes tag.

**Minor style note:** The commit subject uses the full path `gpu/drm/drm_sy=
ncobj` rather than the conventional `drm/syncobj` subsystem prefix used in =
the Fixes tag and by most DRM commits. This is cosmetic only but worth noti=
ng for the maintainer to adjust when applying.

**No issues found with the patch logic.** Clean, minimal, correct fix.

---
Generated by Claude Code Patch Reviewer