From: Dan Carpenter <error27@gmail.com>
To: oe-kbuild@lists.linux.dev, Jason Gunthorpe <jgg@nvidia.com>
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev,
linux-kernel@vger.kernel.org,
"Christian König" <christian.koenig@amd.com>
Subject: drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195)
Date: Thu, 10 Sep 2026 17:15:00 +0300 [thread overview]
Message-ID: <202609081301.6ARYAElY-lkp@intel.com> (raw)
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 28924df2a08f440c73991b83028032c901de2ae4
commit: 6055c9e333cfbb5af3eabe204caea92757094d19 dma-buf: Change st-dma-fence-chain.c to use kunit
config: arm-randconfig-r071-20260908 (https://download.01.org/0day-ci/archive/20260908/202609081301.6ARYAElY-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 2362eeb5f75560740146975e9eabe84c6bd25a0d)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 6055c9e333cf ("dma-buf: Change st-dma-fence-chain.c to use kunit")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202609081301.6ARYAElY-lkp@intel.com/
New smatch warnings:
drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195)
drivers/dma-buf/st-dma-fence-chain.c:339 test_find_gap() error: dereferencing freed memory 'fence' (line 332)
Old smatch warnings:
drivers/dma-buf/st-dma-fence-chain.c:219 test_find_seqno() warn: passing freed memory 'fence' (line 209)
drivers/dma-buf/st-dma-fence-chain.c:228 test_find_seqno() warn: passing freed memory 'fence' (line 221)
drivers/dma-buf/st-dma-fence-chain.c:266 test_find_signaled() error: dereferencing freed memory 'fence' (line 259)
drivers/dma-buf/st-dma-fence-chain.c:307 test_find_out_of_order() error: dereferencing freed memory 'fence' (line 293)
drivers/dma-buf/st-dma-fence-chain.c:346 test_find_gap() warn: passing freed memory 'fence' (line 332)
vim +/fence +207 drivers/dma-buf/st-dma-fence-chain.c
6055c9e333cfbb Jason Gunthorpe 2026-03-01 174 static void test_find_seqno(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 175 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 176 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 177 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 178 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 179 int i;
dc2f7e67a28a5c Chris Wilson 2020-04-09 180
dc2f7e67a28a5c Chris Wilson 2020-04-09 181 err = fence_chains_init(&fc, 64, seqno_inc);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 182 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 183
dc2f7e67a28a5c Chris Wilson 2020-04-09 184 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 185 err = dma_fence_chain_find_seqno(&fence, 0);
dc2f7e67a28a5c Chris Wilson 2020-04-09 186 dma_fence_put(fence);
The zero day bot is warning about this code because it moved, but
calling dma_fence_put() and then calling dma_fence_get() doesn't
make much sense. Why even bother with refcounting it at that point
if we know it's unnecessary?
fence is the same as fc.tail...
I don't think there is any cleanup.h magic for dma fences?
dc2f7e67a28a5c Chris Wilson 2020-04-09 187 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 188 KUNIT_FAIL(test, "Reported %d for find_seqno(0)!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 189 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 190 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 191
dc2f7e67a28a5c Chris Wilson 2020-04-09 192 for (i = 0; i < fc.chain_length; i++) {
dc2f7e67a28a5c Chris Wilson 2020-04-09 193 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 194 err = dma_fence_chain_find_seqno(&fence, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 @195 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 196 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 197 KUNIT_FAIL(test, "Reported %d for find_seqno(%d:%d)!",
dc2f7e67a28a5c Chris Wilson 2020-04-09 198 err, fc.chain_length + 1, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 199 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 200 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 201 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 202 KUNIT_FAIL(test, "Incorrect fence reported by find_seqno(%d:%d)",
dc2f7e67a28a5c Chris Wilson 2020-04-09 203 fc.chain_length + 1, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 204 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 205 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 206
dc2f7e67a28a5c Chris Wilson 2020-04-09 @207 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 208 err = dma_fence_chain_find_seqno(&fence, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 209 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 210 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 211 KUNIT_FAIL(test, "Error reported for finding self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 212 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 213 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 214 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 215 KUNIT_FAIL(test, "Incorrect fence reported by find self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 216 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 217 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 218
dc2f7e67a28a5c Chris Wilson 2020-04-09 219 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 220 err = dma_fence_chain_find_seqno(&fence, i + 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 221 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 222 if (!err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 223 KUNIT_FAIL(test, "Error not reported for future fence: find_seqno(%d:%d)!",
dc2f7e67a28a5c Chris Wilson 2020-04-09 224 i + 1, i + 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 225 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 226 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 227
dc2f7e67a28a5c Chris Wilson 2020-04-09 228 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 229 err = dma_fence_chain_find_seqno(&fence, i);
dc2f7e67a28a5c Chris Wilson 2020-04-09 230 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 231 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 232 KUNIT_FAIL(test, "Error reported for previous fence!");
dc2f7e67a28a5c Chris Wilson 2020-04-09 233 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 234 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 235 if (i > 0 && fence != fc.chains[i - 1]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 236 KUNIT_FAIL(test, "Incorrect fence reported by find_seqno(%d:%d)",
dc2f7e67a28a5c Chris Wilson 2020-04-09 237 i + 1, i);
dc2f7e67a28a5c Chris Wilson 2020-04-09 238 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 239 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 240 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 241
dc2f7e67a28a5c Chris Wilson 2020-04-09 242 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 243 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 244 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 245
6055c9e333cfbb Jason Gunthorpe 2026-03-01 246 static void test_find_signaled(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 247 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 248 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 249 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 250 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 251
dc2f7e67a28a5c Chris Wilson 2020-04-09 252 err = fence_chains_init(&fc, 2, seqno_inc);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 253 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 254
dc2f7e67a28a5c Chris Wilson 2020-04-09 255 dma_fence_signal(fc.fences[0]);
dc2f7e67a28a5c Chris Wilson 2020-04-09 256
dc2f7e67a28a5c Chris Wilson 2020-04-09 257 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 258 err = dma_fence_chain_find_seqno(&fence, 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 259 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 260 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 261 KUNIT_FAIL(test, "Reported %d for find_seqno()!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 262 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 263 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 264
dc2f7e67a28a5c Chris Wilson 2020-04-09 265 if (fence && fence != fc.chains[0]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 266 KUNIT_FAIL(test, "Incorrect chain-fence.seqno:%lld reported for completed seqno:1",
dc2f7e67a28a5c Chris Wilson 2020-04-09 267 fence->seqno);
dc2f7e67a28a5c Chris Wilson 2020-04-09 268
dc2f7e67a28a5c Chris Wilson 2020-04-09 269 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 270 err = dma_fence_chain_find_seqno(&fence, 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 271 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 272 if (err)
6055c9e333cfbb Jason Gunthorpe 2026-03-01 273 KUNIT_FAIL(test, "Reported %d for finding self!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 274 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 275
dc2f7e67a28a5c Chris Wilson 2020-04-09 276 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 277 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 278 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 279
6055c9e333cfbb Jason Gunthorpe 2026-03-01 280 static void test_find_out_of_order(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 281 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 282 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 283 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 284 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 285
dc2f7e67a28a5c Chris Wilson 2020-04-09 286 err = fence_chains_init(&fc, 3, seqno_inc);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 287 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 288
dc2f7e67a28a5c Chris Wilson 2020-04-09 289 dma_fence_signal(fc.fences[1]);
dc2f7e67a28a5c Chris Wilson 2020-04-09 290
dc2f7e67a28a5c Chris Wilson 2020-04-09 291 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 292 err = dma_fence_chain_find_seqno(&fence, 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 293 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 294 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 295 KUNIT_FAIL(test, "Reported %d for find_seqno()!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 296 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 297 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 298
4cca2e64164176 Lionel Landwerlin 2020-06-25 299 /*
4cca2e64164176 Lionel Landwerlin 2020-06-25 300 * We signaled the middle fence (2) of the 1-2-3 chain. The behavior
4cca2e64164176 Lionel Landwerlin 2020-06-25 301 * of the dma-fence-chain is to make us wait for all the fences up to
4cca2e64164176 Lionel Landwerlin 2020-06-25 302 * the point we want. Since fence 1 is still not signaled, this what
4cca2e64164176 Lionel Landwerlin 2020-06-25 303 * we should get as fence to wait upon (fence 2 being garbage
4cca2e64164176 Lionel Landwerlin 2020-06-25 304 * collected during the traversal of the chain).
4cca2e64164176 Lionel Landwerlin 2020-06-25 305 */
6055c9e333cfbb Jason Gunthorpe 2026-03-01 306 if (fence != fc.chains[0])
6055c9e333cfbb Jason Gunthorpe 2026-03-01 307 KUNIT_FAIL(test, "Incorrect chain-fence.seqno:%lld reported for completed seqno:2",
4cca2e64164176 Lionel Landwerlin 2020-06-25 308 fence ? fence->seqno : 0);
dc2f7e67a28a5c Chris Wilson 2020-04-09 309
dc2f7e67a28a5c Chris Wilson 2020-04-09 310 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 311 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 312 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 313
dc2f7e67a28a5c Chris Wilson 2020-04-09 314 static uint64_t seqno_inc2(unsigned int i)
dc2f7e67a28a5c Chris Wilson 2020-04-09 315 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 316 return 2 * i + 2;
dc2f7e67a28a5c Chris Wilson 2020-04-09 317 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 318
6055c9e333cfbb Jason Gunthorpe 2026-03-01 319 static void test_find_gap(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 320 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 321 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 322 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 323 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 324 int i;
dc2f7e67a28a5c Chris Wilson 2020-04-09 325
dc2f7e67a28a5c Chris Wilson 2020-04-09 326 err = fence_chains_init(&fc, 64, seqno_inc2);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 327 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 328
dc2f7e67a28a5c Chris Wilson 2020-04-09 329 for (i = 0; i < fc.chain_length; i++) {
dc2f7e67a28a5c Chris Wilson 2020-04-09 330 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 331 err = dma_fence_chain_find_seqno(&fence, 2 * i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 @332 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 333 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 334 KUNIT_FAIL(test, "Reported %d for find_seqno(%d:%d)!",
dc2f7e67a28a5c Chris Wilson 2020-04-09 335 err, fc.chain_length + 1, 2 * i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 336 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 337 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 338 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 @339 KUNIT_FAIL(test, "Incorrect fence.seqno:%lld reported by find_seqno(%d:%d)",
dc2f7e67a28a5c Chris Wilson 2020-04-09 340 fence->seqno,
dc2f7e67a28a5c Chris Wilson 2020-04-09 341 fc.chain_length + 1,
dc2f7e67a28a5c Chris Wilson 2020-04-09 342 2 * i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 343 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 344 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 345
dc2f7e67a28a5c Chris Wilson 2020-04-09 346 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 347 err = dma_fence_chain_find_seqno(&fence, 2 * i + 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 348 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 349 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 350 KUNIT_FAIL(test, "Error reported for finding self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 351 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 352 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 353 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 354 KUNIT_FAIL(test, "Incorrect fence reported by find self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 355 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 356 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 357 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 358
dc2f7e67a28a5c Chris Wilson 2020-04-09 359 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 360 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 361 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 362
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-09-10 14:20 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-10 14:15 Dan Carpenter [this message]
2026-09-11 7:49 ` Christian König
2026-09-11 12:22 ` Dan Carpenter
2026-09-11 16:26 ` Christian König
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202609081301.6ARYAElY-lkp@intel.com \
--to=error27@gmail.com \
--cc=christian.koenig@amd.com \
--cc=jgg@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@intel.com \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®