Skip to contentSkip to conversation

FAILED: patch "[PATCH] drm/xe/sync: Fix user fence leak on alloc failure" failed to apply to 6.18-stable tree

PATCH New [email protected] 2 participants 3 messages Mar 17 – Mar 18

Subsystems (3)
Stable branch DRM drivers Intel xe
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 6.18-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y
git checkout FETCH_HEAD
git cherry-pick -x 0879c3f04f67e2a1677c25dcc24669ce21eb6a6c
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026031722-spectrum-cocoa-0d75@gregkh' --subject-prefix 'PATCH 6.18.y' HEAD^..

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 0879c3f04f67e2a1677c25dcc24669ce21eb6a6c Mon Sep 17 00:00:00 2001
From: Shuicheng Lin <[email protected]>
Date: Thu, 19 Feb 2026 23:35:19 +0000
Subject: [PATCH] drm/xe/sync: Fix user fence leak on alloc failure

When dma_fence_chain_alloc() fails, properly release the user fence reference to prevent a memory leak.

Fixes 0995c2fc39b0 ("drm/xe: Enforce correct user fence signaling order using")
Cc Matthew Brost <[email protected]>
Signed-off-by Shuicheng Lin <[email protected]>
Reviewed-by Matthew Brost <[email protected]>
Signed-off-by Matthew Brost <[email protected]>
Link https://patch.msgid.link/[email protected] open here
(cherry picked from commit a5d5634cde48a9fcd68c8504aa07f89f175074a0)
Cc [email protected]
Signed-off-by Rodrigo Vivi <[email protected]>
drivers/gpu/drm/xe/xe_sync.c +4 -2
index ebf6c96d7a41..24d6d9af20d6 100644
@@ -206,8 +206,10 @@ int xe_sync_entry_parse(struct xe_device *xe, struct xe_file *xef,
 			if (XE_IOCTL_DBG(xe, IS_ERR(sync->ufence)))
 				return PTR_ERR(sync->ufence);
 			sync->ufence_chain_fence = dma_fence_chain_alloc();
-			if (!sync->ufence_chain_fence)
-				return -ENOMEM;
+			if (!sync->ufence_chain_fence) {
+				err = -ENOMEM;
+				goto free_sync;
+			}
 			sync->ufence_syncobj = ufence_syncobj;
 		}
maintainer
#1 lore raw

PATCH 1/2 drm/xe/sync: Cleanup partially initialized sync on parse failure

From: Shuicheng Lin <[email protected]>

[ Upstream commit 1bfd7575092420ba5a0b944953c95b74a5646ff8 ]

xe_sync_entry_parse() can allocate references (syncobj, fence, chain fence, or user fence) before hitting a later failure path. Several of those paths returned directly, leaving partially initialized state and leaking refs.

Route these error paths through a common free_sync label and call xe_sync_entry_cleanup(sync) before returning the error.

Fixes dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc Matthew Brost <[email protected]>
Signed-off-by Shuicheng Lin <[email protected]>
Reviewed-by Matthew Brost <[email protected]>
Signed-off-by Matthew Brost <[email protected]>
Link https://patch.msgid.link/[email protected] open here
(cherry picked from commit f939bdd9207a5d1fc55cced5459858480686ce22)
Cc [email protected]
Signed-off-by Rodrigo Vivi <[email protected]>

Stable-dep-of: 0879c3f04f67 ("drm/xe/sync: Fix user fence leak on alloc failure")

Signed-off-by Sasha Levin <[email protected]>
---
 drivers/gpu/drm/xe/xe_sync.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)
drivers/gpu/drm/xe/xe_sync.c +17 -7
index d48ab7b32ca51..04c2f44ce0147 100644
@@ -146,8 +146,10 @@ int xe_sync_entry_parse(struct xe_device *xe, struct xe_file *xef,
 
 		if (!signal) {
 			sync->fence = drm_syncobj_fence_get(sync->syncobj);
-			if (XE_IOCTL_DBG(xe, !sync->fence))
-				return -EINVAL;
+			if (XE_IOCTL_DBG(xe, !sync->fence)) {
+				err = -EINVAL;
+				goto free_sync;
+			}
 		}
 		break;
 

@@ -167,17 +169,21 @@ int xe_sync_entry_parse(struct xe_device *xe, struct xe_file *xef,
 
 		if (signal) {
 			sync->chain_fence = dma_fence_chain_alloc();
-			if (!sync->chain_fence)
-				return -ENOMEM;
+			if (!sync->chain_fence) {
+				err = -ENOMEM;
+				goto free_sync;
+			}
 		} else {
 			sync->fence = drm_syncobj_fence_get(sync->syncobj);
-			if (XE_IOCTL_DBG(xe, !sync->fence))
-				return -EINVAL;
+			if (XE_IOCTL_DBG(xe, !sync->fence)) {
+				err = -EINVAL;
+				goto free_sync;
+			}
 
 			err = dma_fence_chain_find_seqno(&sync->fence,
 							 sync_in.timeline_value);
 			if (err)
-				return err;
+				goto free_sync;
 		}
 		break;
 

@@ -216,6 +222,10 @@ int xe_sync_entry_parse(struct xe_device *xe, struct xe_file *xef,
 	sync->timeline_value = sync_in.timeline_value;
 
 	return 0;
+
+free_sync:
+	xe_sync_entry_cleanup(sync);
+	return err;
 }
 ALLOW_ERROR_INJECTION(xe_sync_entry_parse, ERRNO);
Signature · 1 line
2.51.0
maintainer
#2 lore raw

PATCH 2/2 drm/xe/sync: Fix user fence leak on alloc failure

From: Shuicheng Lin <[email protected]>

[ Upstream commit 0879c3f04f67e2a1677c25dcc24669ce21eb6a6c ]

When dma_fence_chain_alloc() fails, properly release the user fence reference to prevent a memory leak.

Fixes 0995c2fc39b0 ("drm/xe: Enforce correct user fence signaling order using")
Cc Matthew Brost <[email protected]>
Signed-off-by Shuicheng Lin <[email protected]>
Reviewed-by Matthew Brost <[email protected]>
Signed-off-by Matthew Brost <[email protected]>
Link https://patch.msgid.link/[email protected] open here
(cherry picked from commit a5d5634cde48a9fcd68c8504aa07f89f175074a0)
Cc [email protected]
Signed-off-by Rodrigo Vivi <[email protected]>
Signed-off-by Sasha Levin <[email protected]>
---
 drivers/gpu/drm/xe/xe_sync.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/xe/xe_sync.c +4 -2
index 04c2f44ce0147..90944218a5906 100644
@@ -206,8 +206,10 @@ int xe_sync_entry_parse(struct xe_device *xe, struct xe_file *xef,
 			if (XE_IOCTL_DBG(xe, IS_ERR(sync->ufence)))
 				return PTR_ERR(sync->ufence);
 			sync->ufence_chain_fence = dma_fence_chain_alloc();
-			if (!sync->ufence_chain_fence)
-				return -ENOMEM;
+			if (!sync->ufence_chain_fence) {
+				err = -ENOMEM;
+				goto free_sync;
+			}
 			sync->ufence_syncobj = ufence_syncobj;
 		}
Signature · 1 line
2.51.0