drm_gem_plane_helper_prepare_fb() takes a reference on state->fence
before checking whether the plane state has a framebuffer. An explicit
fence can be attached to a disabled plane through the IN_FENCE_FD
property, and drm_atomic_plane_check() accepts that state because CRTC
and framebuffer are both unset. The early return for the missing
framebuffer then drops the newly acquired reference without releasing
it.
Move the reference acquisition after the framebuffer check.
Fixes: 1ea28bc5542d ("drm: handle kernel fences in
drm_gem_plane_helper_prepare_fb v2")
Cc: [email protected]
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <[email protected]>
---
drivers/gpu/drm/drm_gem_atomic_helper.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_gem_atomic_helper.c
b/drivers/gpu/drm/drm_gem_atomic_helper.c
index dd9efa7e3216..6c7bdb141905 100644
--- a/drivers/gpu/drm/drm_gem_atomic_helper.c
+++ b/drivers/gpu/drm/drm_gem_atomic_helper.c
@@ -114,7 +114,7 @@
int drm_gem_plane_helper_prepare_fb(struct drm_plane *plane,
struct drm_plane_state *state)
{
- struct dma_fence *fence = dma_fence_get(state->fence);
+ struct dma_fence *fence;
enum dma_resv_usage usage;
size_t i;
int ret;
@@ -122,6 +122,8 @@ int drm_gem_plane_helper_prepare_fb(struct drm_plane *plane,
if (!state->fb)
return 0;
+ fence = dma_fence_get(state->fence);
+
/*
* Only add the kernel fences here if there is already a fence set via
* explicit fencing interfaces on the atomic ioctl.
--
2.34.1
