[PATCH] drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used

[PATCH] drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used

[Thadeu Lima de Souza Cascardo]

Commit 1c6ceeee6ebb ("drm/atomic: Fix memleak on ERESTARTSYS during
non-blocking commits") fixed a very similar issue when the event was
allocated by drm_atomic_helper_setup_commit() itself.

However, if the event is allocated in prepare_signaling(), it will also be
set to NULL in complete_signaling(), which prevents drm_crtc_commit from
being put in __drm_atomic_helper_crtc_destroy_state().

Dropping the reference when the event is set to NULL at
complete_signaling() fixes the leak.

The leak can be reproduced by sending a signal to the thread using
DRM_MODE_PAGE_FLIP_EVENT and using a sw_sync fence to cause the atomic
ioctl to block at drm_atomic_helper_wait_for_fences(). It happened both
with amdgpu and vkms.

Fixes: 24835e442f28 ("drm: reference count event->completion")
Cc: stable@vger.kernel.org
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
---
 drivers/gpu/drm/drm_atomic_uapi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
index e997917819e8..7b951af5ab32 100644
--- a/drivers/gpu/drm/drm_atomic_uapi.c
+++ b/drivers/gpu/drm/drm_atomic_uapi.c
@@ -1563,6 +1563,8 @@ static void complete_signaling(struct drm_device *dev,
 		 * to prevent a double free in drm_atomic_commit_clear.
 		 */
 		if (event && (event->base.fence || event->base.file_priv)) {
+			if (crtc_state->commit && crtc_state->commit->abort_completion)
+				drm_crtc_commit_put(crtc_state->commit);
 			drm_event_cancel_free(dev, &event->base);
 			crtc_state->event = NULL;
 		}

---
base-commit: d5efb1e1b1d7cd27c642654042f80d19a7ba3caf
change-id: 20260727-drm_crtc_atomic_commit_leak-4de5e75162b3

Best regards,
--  
Thadeu Lima de Souza Cascardo <cascardo@igalia.com>

Re: [PATCH] drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used

[Melissa Wen]

On 27/07/2026 22:45, Thadeu Lima de Souza Cascardo wrote:
> Commit 1c6ceeee6ebb ("drm/atomic: Fix memleak on ERESTARTSYS during
> non-blocking commits") fixed a very similar issue when the event was
> allocated by drm_atomic_helper_setup_commit() itself.
>
> However, if the event is allocated in prepare_signaling(), it will also be
> set to NULL in complete_signaling(), which prevents drm_crtc_commit from
> being put in __drm_atomic_helper_crtc_destroy_state().
>
> Dropping the reference when the event is set to NULL at
> complete_signaling() fixes the leak.
>
> The leak can be reproduced by sending a signal to the thread using
> DRM_MODE_PAGE_FLIP_EVENT and using a sw_sync fence to cause the atomic
> ioctl to block at drm_atomic_helper_wait_for_fences(). It happened both
> with amdgpu and vkms.

Nice catch!

- Do you have a reproducer or is there an IGT test that triggers this issue?

- cc'ing Leo and Harry as well because they worked on the similar issue 
and must be interested in it.

- I think it should point to stable # v4.11+ as in commit 1c6ceeee6ebb

Reviewed-by: Melissa Wen <mwen@igalia.com>

Thanks!

>
> Fixes: 24835e442f28 ("drm: reference count event->completion")
> Cc: stable@vger.kernel.org
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
> ---
>   drivers/gpu/drm/drm_atomic_uapi.c | 2 ++
>   1 file changed, 2 insertions(+)
>
> diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
> index e997917819e8..7b951af5ab32 100644
> --- a/drivers/gpu/drm/drm_atomic_uapi.c
> +++ b/drivers/gpu/drm/drm_atomic_uapi.c
> @@ -1563,6 +1563,8 @@ static void complete_signaling(struct drm_device *dev,
>   		 * to prevent a double free in drm_atomic_commit_clear.
>   		 */
>   		if (event && (event->base.fence || event->base.file_priv)) {
> +			if (crtc_state->commit && crtc_state->commit->abort_completion)
> +				drm_crtc_commit_put(crtc_state->commit);
>   			drm_event_cancel_free(dev, &event->base);
>   			crtc_state->event = NULL;
>   		}
>
> ---
> base-commit: d5efb1e1b1d7cd27c642654042f80d19a7ba3caf
> change-id: 20260727-drm_crtc_atomic_commit_leak-4de5e75162b3
>
> Best regards,
> --
> Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
>

Re: [PATCH] drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used

[Melissa Wen]

On 18/08/2026 12:27, Melissa Wen wrote:
>
>
> On 27/07/2026 22:45, Thadeu Lima de Souza Cascardo wrote:
>> Commit 1c6ceeee6ebb ("drm/atomic: Fix memleak on ERESTARTSYS during
>> non-blocking commits") fixed a very similar issue when the event was
>> allocated by drm_atomic_helper_setup_commit() itself.
>>
>> However, if the event is allocated in prepare_signaling(), it will 
>> also be
>> set to NULL in complete_signaling(), which prevents drm_crtc_commit from
>> being put in __drm_atomic_helper_crtc_destroy_state().
>>
>> Dropping the reference when the event is set to NULL at
>> complete_signaling() fixes the leak.
>>
>> The leak can be reproduced by sending a signal to the thread using
>> DRM_MODE_PAGE_FLIP_EVENT and using a sw_sync fence to cause the atomic
>> ioctl to block at drm_atomic_helper_wait_for_fences(). It happened both
>> with amdgpu and vkms.
>
> Nice catch!
>
> - Do you have a reproducer or is there an IGT test that triggers this 
> issue?
>
> - cc'ing Leo and Harry as well because they worked on the similar 
> issue and must be interested in it.
>
> - I think it should point to stable # v4.11+ as in commit 1c6ceeee6ebb
>
> Reviewed-by: Melissa Wen <mwen@igalia.com>

Applied to drm-misc-fixes.
commit: 4d4be202165e832d74849b4a68e289a2a377039c

Melissa

>
> Thanks!
>
>>
>> Fixes: 24835e442f28 ("drm: reference count event->completion")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
>> ---
>>   drivers/gpu/drm/drm_atomic_uapi.c | 2 ++
>>   1 file changed, 2 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/drm_atomic_uapi.c 
>> b/drivers/gpu/drm/drm_atomic_uapi.c
>> index e997917819e8..7b951af5ab32 100644
>> --- a/drivers/gpu/drm/drm_atomic_uapi.c
>> +++ b/drivers/gpu/drm/drm_atomic_uapi.c
>> @@ -1563,6 +1563,8 @@ static void complete_signaling(struct 
>> drm_device *dev,
>>            * to prevent a double free in drm_atomic_commit_clear.
>>            */
>>           if (event && (event->base.fence || event->base.file_priv)) {
>> +            if (crtc_state->commit && 
>> crtc_state->commit->abort_completion)
>> +                drm_crtc_commit_put(crtc_state->commit);
>>               drm_event_cancel_free(dev, &event->base);
>>               crtc_state->event = NULL;
>>           }
>>
>> ---
>> base-commit: d5efb1e1b1d7cd27c642654042f80d19a7ba3caf
>> change-id: 20260727-drm_crtc_atomic_commit_leak-4de5e75162b3
>>
>> Best regards,
>> -- 
>> Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
>>
>