[PATCH] drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()

[PATCH] drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()

[Wentao Liang]

amdgpu_ring_init() initializes ring->vmid_wait with a reference to the
stub fence taken via dma_fence_get_stub().  When a later step of the
initialization fails, e.g. amdgpu_fence_driver_init_ring(), a writeback
slot allocation or the ring buffer allocation, the function returns an
error without releasing the stub fence reference and the reference is
leaked if the ring is torn down without amdgpu_ring_fini().

Move the stub fence assignment to the end of the initialization, right
before the ring is registered with the GPU scheduler, where no further
failure is possible.  The stub fence is only consumed by command
submission handling in amdgpu_ids.c once the ring is up and running, so
nothing reads it during the error-prone part of the initialization.

Fixes: 48e9fbd1a284 ("drm/amdgpu: initialize the vmid_wait with the stub fence")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
index d6bee5c30073..8c12c373ab7b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
@@ -254,7 +254,6 @@ int amdgpu_ring_init(struct amdgpu_device *adev, struct amdgpu_ring *ring,
 		ring->adev = adev;
 		ring->num_hw_submission = sched_hw_submission;
 		ring->sched_score = sched_score;
-		ring->vmid_wait = dma_fence_get_stub();
 
 		ring->idx = adev->num_rings++;
 		adev->rings[ring->idx] = ring;
@@ -374,6 +373,7 @@ int amdgpu_ring_init(struct amdgpu_device *adev, struct amdgpu_ring *ring,
 
 	ring->max_dw = max_dw;
 	ring->hw_prio = hw_prio;
+	ring->vmid_wait = dma_fence_get_stub();
 
 	if (!ring->no_scheduler && ring->funcs->type < AMDGPU_HW_IP_NUM) {
 		hw_ip = ring->funcs->type;
-- 
2.34.1

RE: [PATCH] drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()

[Deucher, Alexander]

AMD General

Applied.  Thanks!

> -----Original Message-----
> From: Wentao Liang <vulab@iscas.ac.cn>
> Sent: Wednesday, September 16, 2026 6:02 AM
> To: airlied@gmail.com
> Cc: Deucher, Alexander <Alexander.Deucher@amd.com>; amd-
> gfx@lists.freedesktop.org; andrey.grodzovsky@amd.com; Koenig, Christian
> <Christian.Koenig@amd.com>; dri-devel@lists.freedesktop.org; linux-
> kernel@vger.kernel.org; simona@ffwll.ch; Wentao Liang <vulab@iscas.ac.cn>;
> stable@vger.kernel.org
> Subject: [PATCH] drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
>
> amdgpu_ring_init() initializes ring->vmid_wait with a reference to the stub
> fence taken via dma_fence_get_stub().  When a later step of the initialization
> fails, e.g. amdgpu_fence_driver_init_ring(), a writeback slot allocation or the
> ring buffer allocation, the function returns an error without releasing the stub
> fence reference and the reference is leaked if the ring is torn down without
> amdgpu_ring_fini().
>
> Move the stub fence assignment to the end of the initialization, right before
> the ring is registered with the GPU scheduler, where no further failure is
> possible.  The stub fence is only consumed by command submission handling
> in amdgpu_ids.c once the ring is up and running, so nothing reads it during the
> error-prone part of the initialization.
>
> Fixes: 48e9fbd1a284 ("drm/amdgpu: initialize the vmid_wait with the stub
> fence")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
> index d6bee5c30073..8c12c373ab7b 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
> @@ -254,7 +254,6 @@ int amdgpu_ring_init(struct amdgpu_device *adev,
> struct amdgpu_ring *ring,
>               ring->adev = adev;
>               ring->num_hw_submission = sched_hw_submission;
>               ring->sched_score = sched_score;
> -             ring->vmid_wait = dma_fence_get_stub();
>
>               ring->idx = adev->num_rings++;
>               adev->rings[ring->idx] = ring;
> @@ -374,6 +373,7 @@ int amdgpu_ring_init(struct amdgpu_device *adev,
> struct amdgpu_ring *ring,
>
>       ring->max_dw = max_dw;
>       ring->hw_prio = hw_prio;
> +     ring->vmid_wait = dma_fence_get_stub();
>
>       if (!ring->no_scheduler && ring->funcs->type <
> AMDGPU_HW_IP_NUM) {
>               hw_ip = ring->funcs->type;
> --
> 2.34.1