Re: [PATCH] drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used

[Melissa Wen <mwen@igalia.com>]

On 18/08/2026 12:27, Melissa Wen wrote:
>
>
> On 27/07/2026 22:45, Thadeu Lima de Souza Cascardo wrote:
>> Commit 1c6ceeee6ebb ("drm/atomic: Fix memleak on ERESTARTSYS during
>> non-blocking commits") fixed a very similar issue when the event was
>> allocated by drm_atomic_helper_setup_commit() itself.
>>
>> However, if the event is allocated in prepare_signaling(), it will 
>> also be
>> set to NULL in complete_signaling(), which prevents drm_crtc_commit from
>> being put in __drm_atomic_helper_crtc_destroy_state().
>>
>> Dropping the reference when the event is set to NULL at
>> complete_signaling() fixes the leak.
>>
>> The leak can be reproduced by sending a signal to the thread using
>> DRM_MODE_PAGE_FLIP_EVENT and using a sw_sync fence to cause the atomic
>> ioctl to block at drm_atomic_helper_wait_for_fences(). It happened both
>> with amdgpu and vkms.
>
> Nice catch!
>
> - Do you have a reproducer or is there an IGT test that triggers this 
> issue?
>
> - cc'ing Leo and Harry as well because they worked on the similar 
> issue and must be interested in it.
>
> - I think it should point to stable # v4.11+ as in commit 1c6ceeee6ebb
>
> Reviewed-by: Melissa Wen <mwen@igalia.com>

Applied to drm-misc-fixes.
commit: 4d4be202165e832d74849b4a68e289a2a377039c

Melissa

>
> Thanks!
>
>>
>> Fixes: 24835e442f28 ("drm: reference count event->completion")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
>> ---
>>   drivers/gpu/drm/drm_atomic_uapi.c | 2 ++
>>   1 file changed, 2 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/drm_atomic_uapi.c 
>> b/drivers/gpu/drm/drm_atomic_uapi.c
>> index e997917819e8..7b951af5ab32 100644
>> --- a/drivers/gpu/drm/drm_atomic_uapi.c
>> +++ b/drivers/gpu/drm/drm_atomic_uapi.c
>> @@ -1563,6 +1563,8 @@ static void complete_signaling(struct 
>> drm_device *dev,
>>            * to prevent a double free in drm_atomic_commit_clear.
>>            */
>>           if (event && (event->base.fence || event->base.file_priv)) {
>> +            if (crtc_state->commit && 
>> crtc_state->commit->abort_completion)
>> +                drm_crtc_commit_put(crtc_state->commit);
>>               drm_event_cancel_free(dev, &event->base);
>>               crtc_state->event = NULL;
>>           }
>>
>> ---
>> base-commit: d5efb1e1b1d7cd27c642654042f80d19a7ba3caf
>> change-id: 20260727-drm_crtc_atomic_commit_leak-4de5e75162b3
>>
>> Best regards,
>> -- 
>> Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
>>
>