RE: [PATCH] drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()

[Deucher, Alexander]

AMD General

Applied.  Thanks!

> -----Original Message-----
> From: Wentao Liang <vulab@xxxxxxxxxxx>
> Sent: Wednesday, September 16, 2026 6:02 AM
> To: airlied@xxxxxxxxx
> Cc: Deucher, Alexander <Alexander.Deucher@xxxxxxx>; amd-
> gfx@xxxxxxxxxxxxxxxxxxxxx; andrey.grodzovsky@xxxxxxx; Koenig, Christian
> <Christian.Koenig@xxxxxxx>; dri-devel@xxxxxxxxxxxxxxxxxxxxx; linux-
> kernel@xxxxxxxxxxxxxxx; simona@xxxxxxxx; Wentao Liang <vulab@xxxxxxxxxxx>;
> stable@xxxxxxxxxxxxxxx
> Subject: [PATCH] drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
>
> amdgpu_ring_init() initializes ring->vmid_wait with a reference to the stub
> fence taken via dma_fence_get_stub().  When a later step of the initialization
> fails, e.g. amdgpu_fence_driver_init_ring(), a writeback slot allocation or the
> ring buffer allocation, the function returns an error without releasing the stub
> fence reference and the reference is leaked if the ring is torn down without
> amdgpu_ring_fini().
>
> Move the stub fence assignment to the end of the initialization, right before
> the ring is registered with the GPU scheduler, where no further failure is
> possible.  The stub fence is only consumed by command submission handling
> in amdgpu_ids.c once the ring is up and running, so nothing reads it during the
> error-prone part of the initialization.
>
> Fixes: 48e9fbd1a284 ("drm/amdgpu: initialize the vmid_wait with the stub
> fence")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
> index d6bee5c30073..8c12c373ab7b 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
> @@ -254,7 +254,6 @@ int amdgpu_ring_init(struct amdgpu_device *adev,
> struct amdgpu_ring *ring,
>               ring->adev = adev;
>               ring->num_hw_submission = sched_hw_submission;
>               ring->sched_score = sched_score;
> -             ring->vmid_wait = dma_fence_get_stub();
>
>               ring->idx = adev->num_rings++;
>               adev->rings[ring->idx] = ring;
> @@ -374,6 +373,7 @@ int amdgpu_ring_init(struct amdgpu_device *adev,
> struct amdgpu_ring *ring,
>
>       ring->max_dw = max_dw;
>       ring->hw_prio = hw_prio;
> +     ring->vmid_wait = dma_fence_get_stub();
>
>       if (!ring->no_scheduler && ring->funcs->type <
> AMDGPU_HW_IP_NUM) {
>               hw_ip = ring->funcs->type;
> --
> 2.34.1