From 54d892b20a412a204d890e4a1d0e3632ab7ec787 Mon Sep 17 00:00:00 2001 From: Shaurya Rane Date: Thu, 4 Dec 2025 21:10:48 +0530 Subject: [PATCH] drm/atomic: fix memory leak in prepare_signaling() error path When prepare_signaling() creates a vblank event for an out-fence but fails before attaching the fence (e.g., krealloc or drm_crtc_create_fence fails), complete_signaling() only frees events with fence or file_priv set, leaking the partially initialized event. Add an else branch to kfree events that have neither fence nor file_priv. Reported-by: syzbot+3fc9eecaf97147282c87@syzkaller.appspotmail.com Signed-off-by: Shaurya Rane --- drivers/gpu/drm/drm_atomic_uapi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c index 85dbdaa4a2e2..d3f23b640d34 100644 --- a/drivers/gpu/drm/drm_atomic_uapi.c +++ b/drivers/gpu/drm/drm_atomic_uapi.c @@ -1348,6 +1348,9 @@ static void complete_signaling(struct drm_device *dev, if (event && (event->base.fence || event->base.file_priv)) { drm_event_cancel_free(dev, &event->base); crtc_state->event = NULL; + } else if (event) { + kfree(event); + crtc_state->event = NULL; } } -- 2.34.1