Re: [PATCH] drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used

[Melissa Wen <mwen@igalia.com>]

On 27/07/2026 22:45, Thadeu Lima de Souza Cascardo wrote:
> Commit 1c6ceeee6ebb ("drm/atomic: Fix memleak on ERESTARTSYS during
> non-blocking commits") fixed a very similar issue when the event was
> allocated by drm_atomic_helper_setup_commit() itself.
>
> However, if the event is allocated in prepare_signaling(), it will also be
> set to NULL in complete_signaling(), which prevents drm_crtc_commit from
> being put in __drm_atomic_helper_crtc_destroy_state().
>
> Dropping the reference when the event is set to NULL at
> complete_signaling() fixes the leak.
>
> The leak can be reproduced by sending a signal to the thread using
> DRM_MODE_PAGE_FLIP_EVENT and using a sw_sync fence to cause the atomic
> ioctl to block at drm_atomic_helper_wait_for_fences(). It happened both
> with amdgpu and vkms.

Nice catch!

- Do you have a reproducer or is there an IGT test that triggers this issue?

- cc'ing Leo and Harry as well because they worked on the similar issue 
and must be interested in it.

- I think it should point to stable # v4.11+ as in commit 1c6ceeee6ebb

Reviewed-by: Melissa Wen <mwen@igalia.com>

Thanks!

>
> Fixes: 24835e442f28 ("drm: reference count event->completion")
> Cc: stable@vger.kernel.org
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
> ---
>   drivers/gpu/drm/drm_atomic_uapi.c | 2 ++
>   1 file changed, 2 insertions(+)
>
> diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
> index e997917819e8..7b951af5ab32 100644
> --- a/drivers/gpu/drm/drm_atomic_uapi.c
> +++ b/drivers/gpu/drm/drm_atomic_uapi.c
> @@ -1563,6 +1563,8 @@ static void complete_signaling(struct drm_device *dev,
>   		 * to prevent a double free in drm_atomic_commit_clear.
>   		 */
>   		if (event && (event->base.fence || event->base.file_priv)) {
> +			if (crtc_state->commit && crtc_state->commit->abort_completion)
> +				drm_crtc_commit_put(crtc_state->commit);
>   			drm_event_cancel_free(dev, &event->base);
>   			crtc_state->event = NULL;
>   		}
>
> ---
> base-commit: d5efb1e1b1d7cd27c642654042f80d19a7ba3caf
> change-id: 20260727-drm_crtc_atomic_commit_leak-4de5e75162b3
>
> Best regards,
> --
> Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
>