Re: [PATCH] fix: drm: drm_syncobj_find_fence: invalid flags check before NULL check leaks syncobj reference

[WenTao Liang]

> 2026年6月26日 21:17，WenTao Liang <vu...@iscas.ac.cn> 写道：
> 
> drm_syncobj_find() acquires a syncobj reference on success. The invalid
>  flags check at line 445 returns -EINVAL without calling drm_syncobj_put,
>  bypassing the out label where the reference would be released. The flags
>  check should be moved after the NULL check, or drm_syncobj_put should be
>  called before the early return.
> 
> Cc: sta...@vger.kernel.org
> Fixes: 18226ba52159 ("drm/syncobj: reject invalid flags in 
> drm_syncobj_find_fence")
> Signed-off-by: WenTao Liang <vu...@iscas.ac.cn>
> ---
> drivers/gpu/drm/drm_syncobj.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
> index 8d9fd1917c6e..e40e2d92d5ef 100644
> --- a/drivers/gpu/drm/drm_syncobj.c
> +++ b/drivers/gpu/drm/drm_syncobj.c
> @@ -442,12 +442,14 @@ int drm_syncobj_find_fence(struct drm_file 
> *file_private,
>       u64 timeout = nsecs_to_jiffies64(DRM_SYNCOBJ_WAIT_FOR_SUBMIT_TIMEOUT);
>       int ret;
> 
> -     if (flags & ~DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)
> -             return -EINVAL;
> -
>       if (!syncobj)
>               return -ENOENT;
> 
> +     if (flags & ~DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) {
> +             drm_syncobj_put(syncobj);
> +             return -EINVAL;
> +     }
> +
>       /* Waiting for userspace with locks help is illegal cause that can
>        * trivial deadlock with page faults for example. Make lockdep complain
>        * about it early on.
> -- 
> 2.39.5 (Apple Git-154)

Please ignore this patch. I will resend a proper version after
learning the kernel submission process.

Apologies for the noise.

Best regards,
WenTao Liang