Re: [PATCH] fix: dma-buf: fence_chains_init: error unwind path leaks enable_sw_signaling reference

["Christian König" <christian.koenig@amd.com>]

On 6/26/26 14:18, WenTao Liang wrote:
> dma_fence_enable_sw_signaling acquires an extra reference on each chain
>   fence. The error unwind loop calls dma_fence_put only once per
>   chain/fence without first signaling the fence to trigger the callback
>   that releases the signaling reference. This prevents the chain fence kref
>   from reaching 0, permanently leaking the chain and its contained fence.
> 
> Cc: stable@vger.kernel.org
> Fixes: dc2f7e67a28a ("dma-buf: Exercise dma-fence-chain under selftests")

Please drop that, this is a minor issue in a unit test and not anything which needs backporting.

> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/dma-buf/st-dma-fence-chain.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/dma-buf/st-dma-fence-chain.c b/drivers/dma-buf/st-dma-fence-chain.c
> index 821023dd34df..7dc18e294387 100644
> --- a/drivers/dma-buf/st-dma-fence-chain.c
> +++ b/drivers/dma-buf/st-dma-fence-chain.c
> @@ -152,7 +152,10 @@ static int fence_chains_init(struct fence_chains *fc, unsigned int count,
>  
>  unwind:
>  	for (i = 0; i < count; i++) {
> -		dma_fence_put(fc->fences[i]);
> +		if (fc->fences[i]) {
> +			dma_fence_signal(fc->fences[i]);
> +			dma_fence_put(fc->fences[i]);
> +		}

The usual text book idiom for such cleanup cases is:

while (i--) {
	dma_fence_signal(fc->fences[i]);
	dma_fence_put(fc->chains[i]);
}

Additional to that we need a different error handling target for the case that the mock_chain() allocation fails (or just do another dma_fence_put there).

Regards,
Christian.

>  		dma_fence_put(fc->chains[i]);
>  	}
>  	kvfree(fc->fences);