From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f169.google.com (mail-pf1-f169.google.com [209.85.210.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 34EEF13635E for ; Mon, 29 Jun 2026 03:13:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782702839; cv=none; b=L13MbPoULmgbG+8DQ3xYloHiztSPD6X9s6CnJWO1YGfGaNR2NSz1FMFORIyFvlqLJZwGLjhwCyupavSZghB5JLUv0c+JpV+oScpEEFy1i/u7cf3eZBbS5NaTYTyDtRbMn/eQFZXEoRY+W5dPNm62e44G3Ciz0SayvDDsQxqqaFg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782702839; c=relaxed/simple; bh=cA0miXNy764U+mxajh7wNC0vJ/SclL1zAKmOx2jfnzc=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=U5hO0JfamPEn6gzsovqmZZV+jE0l3GkgdVd9RwI3kX4dskMBE82wuo43FytYo6ffjCbwNZO/9QLaapGygi8lrJNhfmkPUptYEL//B5PFmkg8iBP4KPkRuqeVYSswobAD0lq2YmtVw4lF1YxcwVPuwd8dV3kHtrLmnor1CqZyMUs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=GNJWt5VI; arc=none smtp.client-ip=209.85.210.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="GNJWt5VI" Received: by mail-pf1-f169.google.com with SMTP id d2e1a72fcca58-84594492c26so2206449b3a.2 for ; Sun, 28 Jun 2026 20:13:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782702837; x=1783307637; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=vIf1UjIu4HobsLfku1GIoLJNf/dF/mUSSo+eQGmmVZs=; b=GNJWt5VIKwOe+cRCpZeLVoIsl3fmdrJIUxFPB3YTe+zb6EmBuHz2n7gn1J7+bGxKqN /QbyIEWleI+NiiGvt9/KdCR5LbrgO8nO1T1Krl6wT0bbB8C5u15rztC1wm0SWVN4Htdt u/fjo/KmpCaY5Ge9PL0Zi3fo3hv+Q2mL6aAMQ5sYwVqP4xUopEQFXwNuqsXNtje3Szka K8PwhwO1IIMV47fO7T0mUELXIA2asnUM0ywy2XC+CQj4LF+Sbic5Pl6ipaiF+J4j4KHn 5r2qClTSMyexeUiKxDswr3FoyMBEvYQagkRBB3V21BkElLEwB4r5rmt1Janh0IqisvTD 4gRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782702837; x=1783307637; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=vIf1UjIu4HobsLfku1GIoLJNf/dF/mUSSo+eQGmmVZs=; b=WMRvQj+prQckShCY+xrY/fmIMLIGanK99GwlN4E+a3leghCc+aS3qq5WcqXeNb63Sy xYr1/799tnnU++Nv003vfxqwoAAgg1osDyeUnX3CfJ1Ycu5WyCRtA+PuRkx3t5pYbAYp /OvVC4pNaszEB/hzBM/nqGZITvbhtzm++TTwTsBd/zFdzm+qJ1TXwlkYFnElrcbek9p/ Ylc2B5e7QeFJ+BKW1Q9+xhv6HWzecpt+8/CwpQH578mHaFO6vZG7p5+2yjIjK1rvtD8y fqjo2MCOmolJpbLUgQPH1aiKi19zS3YD7jMOLb8zKDQEnb/Zr2Z2he586N3J0PbR5tZb NlTg== X-Forwarded-Encrypted: i=1; AHgh+RpadQoL0KTB9sE06L2NuDNYKppR+u1H4VdnH7s5dgpS5B3N72oyk3TTKcB8S0h71JXzUA8oW+j5OiIhxcg=@vger.kernel.org X-Gm-Message-State: AOJu0YxeosoqEhCZyEHOsWdQp5cwIfaUVhwtDNtwPHIN/L+2u89nIFki M+8eFi733jaVP0hq8aA9NJEkLuHs835MPj3V7RNWczmZ4H60Ss7hkYSj X-Gm-Gg: AfdE7clogx56wSCTb+CMRbjnERwbKqiZxUz+hbBa27QQ5v7/2fGclvmy0FyNXh2IOI6 TJeifrRap2udWJtxJ8tFacko0y82M4GVohYNedSm2tkyYeq/EJPj1GTFKlj3DSroyAKQyYQS62v /F3IP0qRY+C1KYt2rpvVRAi1qMj8fNS7wl+Ivuo+278h+iljEsXJU2l+iPV9x2ghW1PfwULpvCu j89kspDJPiT+sf6UbgLhloXJdlHJO32XpoSIi/43PiMvjEZxlHsxrFjsx4Wq+Q69iGmQHbRmI5I uBLOavoGC4DIzznD+OBYghzBECFMVIDL8R7Rumyt20vcY0H3ljApxWvhoBXFIrYIhm03NFFjF1N Dq2E/ynoFyFamyAkKG3Wtb6B6nkmPc3aeLUJwDzHWjWoeeCMrWt2XBQGsDhJAmoW9sASaPBQVwe f4fFombOLvZc08QyeR8CLSZjM1KPv1 X-Received: by 2002:a05:6a00:94f1:b0:847:88eb:1e00 with SMTP id d2e1a72fcca58-84788eb24femr987190b3a.49.1782702837428; Sun, 28 Jun 2026 20:13:57 -0700 (PDT) Received: from localhost.localdomain ([117.133.183.252]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-845a4121fdbsm10761359b3a.51.2026.06.28.20.13.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 28 Jun 2026 20:13:57 -0700 (PDT) From: Baineng Shou To: Sumit Semwal , =?UTF-8?q?Christian=20K=C3=B6nig?= Cc: Tvrtko Ursulin , Philipp Stanner , Akash Goel , linux-media@vger.kernel.org, dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Baineng Shou Subject: [PATCH] dma-fence: Make dma_fence_dedup_array() robust against 0-count input Date: Mon, 29 Jun 2026 11:13:46 +0800 Message-Id: <20260629031346.3875683-1-shoubaineng@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit dma_fence_dedup_array() returns 1 when called with num_fences == 0: the for-loop body never executes, j stays at 0, and the final `return ++j` yields 1. This contradicts both the kernel-doc ("Return: Number of unique fences remaining in the array") and the natural expectation that 0 input gives 0 output. All in-tree callers currently filter num_fences == 0 before invoking this helper (__dma_fence_unwrap_merge() bails out via the `if (count == 0 || count == 1)` fast path; amdgpu_userq_wait_*() cannot reach the dedup call with a zero local count because the amdgpu_userq_wait_add_fence() helper guarantees num_fences stays in [0, wait_info->num_fences], and wait_info->num_fences > 0 is enforced at the ioctl entry). However, dma_fence_dedup_array() is EXPORT_SYMBOL_GPL, so any future caller that forgets to pre-filter the zero case will get a misleading return value of 1. Depending on how that caller uses the result, it could dereference an uninitialized fence slot in the array, since the caller's array may have been allocated but not yet populated. Make the contract match the documentation by returning 0 early. This also skips an unnecessary sort() call on an empty array. Signed-off-by: Baineng Shou --- drivers/dma-buf/dma-fence-unwrap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/dma-buf/dma-fence-unwrap.c b/drivers/dma-buf/dma-fence-unwrap.c index 53bb40e70b27..364cbf79ad73 100644 --- a/drivers/dma-buf/dma-fence-unwrap.c +++ b/drivers/dma-buf/dma-fence-unwrap.c @@ -97,6 +97,9 @@ int dma_fence_dedup_array(struct dma_fence **fences, int num_fences) { int i, j; + if (!num_fences) + return 0; + sort(fences, num_fences, sizeof(*fences), fence_cmp, NULL); /* -- 2.34.1