drm/syncobj: handle NULL fence in syncobj_eventfd_entry_func

From Erik Kurzinger
20e1e1a2b8a4525301a76bd9afb856a7606a3a34 in linux-6.6.y/6.6.19
2aa6f5b0fd052e363bb9d4b547189f0bf6b3d6d3 in mainline linux

1 files changed, 12 insertions, 1 deletions

diff --git a/sys/dev/pci/drm/drm_syncobj.c b/sys/dev/pci/drm/drm_syncobj.c
index 9d722d5d6a6..841bc90810e 100644
--- a/sys/dev/pci/drm/drm_syncobj.c
+++ b/sys/dev/pci/drm/drm_syncobj.c
@@ -1446,10 +1446,21 @@ syncobj_eventfd_entry_func(struct drm_syncobj *syncobj,
 
 	/* This happens inside the syncobj lock */
 	fence = dma_fence_get(rcu_dereference_protected(syncobj->fence, 1));
+	if (!fence)
+		return;
+
 	ret = dma_fence_chain_find_seqno(&fence, entry->point);
-	if (ret != 0 || !fence) {
+	if (ret != 0) {
+		/* The given seqno has not been submitted yet. */
 		dma_fence_put(fence);
 		return;
+	} else if (!fence) {
+		/* If dma_fence_chain_find_seqno returns 0 but sets the fence
+		 * to NULL, it implies that the given seqno is signaled and a
+		 * later seqno has already been submitted. Assign a stub fence
+		 * so that the eventfd still gets signaled below.
+		 */
+		fence = dma_fence_get_stub();
 	}
 
 	list_del_init(&entry->node);