From bc61efabe79263fd6215a8b4a59a398cc82712bf Mon Sep 17 00:00:00 2001 From: Vaggelis Date: Mon, 24 Aug 2026 11:48:57 -0400 Subject: [PATCH] nvidia-drm: propagate errno from semaphore surface fence wait ioctl nv_drm_semsurf_fence_wait_ioctl() initializes ret to -EINVAL and sets it to 0 on the success paths, but ends in a bare return 0. Every validation failure (non-monotonic wait values, unknown fence context handle, wrong context type, allocation failure, invalid sync FD) logs an error and then reports success to userspace even though no wait was registered with RM. A caller that trusts the return value believes its wait is armed; the semaphore it waits on is never signaled and the caller hangs (#1297). Return ret instead. The success paths still return 0, including the deliberate proceed-as-signaled path where dma_fence_add_callback() failed after the wait was registered with RM, and the early -EOPNOTSUPP check is unchanged. Sibling ioctls in this file already propagate their errno the same way. Test Plan: No build or runtime test possible in the preparation environment (no Linux kernel toolchain, no NVIDIA GPU). Verified statically: git diff --stat : 1 file changed, 1 insertion(+), 1 deletion(-) Traced all eight paths through the function: error paths reach done: with ret == -EINVAL while wait_data is NULL or unshared, success paths set ret = 0 before the label, and the callback- registration-failure path resets ret to 0 after running the work callback inline, so no double free and no success-path change. --- kernel-open/nvidia-drm/nvidia-drm-fence.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel-open/nvidia-drm/nvidia-drm-fence.c b/kernel-open/nvidia-drm/nvidia-drm-fence.c index 7af1ed7f13..bd52718a2d 100644 --- a/kernel-open/nvidia-drm/nvidia-drm-fence.c +++ b/kernel-open/nvidia-drm/nvidia-drm-fence.c @@ -1742,7 +1742,7 @@ int nv_drm_semsurf_fence_wait_ioctl(struct drm_device *dev, nv_drm_gem_object_unreference_unlocked(&nv_fence_context->base); done: - return 0; + return ret; } int nv_drm_semsurf_fence_attach_ioctl(struct drm_device *dev,