Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Critical] Use-After-Free and List Corruption in DRM Atomic Error Path --
--- Patch [1]: [PATCH] drm: Fix drm_pending_vblank_event in error path for out_fence_ptr --- commit d91030dbda8d5aae203f2c2d58622099629e2e8a Author: Thadeu Lima de Souza Cascardo <[email protected]> drm: Fix drm_pending_vblank_event in error path for out_fence_ptr This commit frees the allocated drm_pending_vblank_event when setting up an out_fence_ptr fails. This prevents a leak if there is an allocation or setup failure after the event was created but DRM_MODE_PAGE_FLIP_EVENT was not set. Link: https://sashiko.dev/#/patchset/20260727-drm_crtc_atomic_commit_leak-v1-1-23d9948a9...@igalia.com?part=1 > diff --git a/drivers/gpu/drm/drm_atomic_uapi.c > b/drivers/gpu/drm/drm_atomic_uapi.c > --- a/drivers/gpu/drm/drm_atomic_uapi.c > +++ b/drivers/gpu/drm/drm_atomic_uapi.c [ ... ] > @@ -1464,11 +1464,15 @@ static int prepare_signaling(struct drm_device *dev, > if (fence_ptr) { > struct dma_fence *fence; > struct drm_out_fence_state *f; > + struct drm_pending_vblank_event *e = crtc_state->event; > > f = krealloc(*fence_state, sizeof(**fence_state) * > (*num_fences + 1), GFP_KERNEL); > - if (!f) > + if (!f) { > + kfree(e); > + crtc_state->event = NULL; > return -ENOMEM; > + } > > memset(&f[*num_fences], 0, sizeof(*f)); > > @@ -1476,12 +1480,17 @@ static int prepare_signaling(struct drm_device *dev, > *fence_state = f; > > fence = drm_crtc_create_fence(crtc); > - if (!fence) > + if (!fence) { > + kfree(e); > + crtc_state->event = NULL; > return -ENOMEM; > + } > > ret = setup_out_fence(&f[(*num_fences)++], fence); > if (ret) { > dma_fence_put(fence); > + kfree(e); > + crtc_state->event = NULL; > return ret; > } [Severity: Critical] Can these error paths cause a use-after-free and list corruption if DRM_MODE_PAGE_FLIP_EVENT was also set? If DRM_MODE_PAGE_FLIP_EVENT is set, the code just prior to this block calls drm_event_reserve_init() which adds the event to the pending_event_list: if (arg->flags & DRM_MODE_PAGE_FLIP_EVENT) { ... ret = drm_event_reserve_init(dev, file_priv, &e->base, &e->event.base); ... } If the out fence allocations or setup_out_fence() subsequently fail, kfree(e) is called directly in the new error paths without unlinking the event. Traversing the pending_event_list later (such as during file close in drm_events_release) could then access freed memory. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/20260728-drm_pending_vblank_event_leak-v1-1-08429b920...@igalia.com?part=1
