[PATCH] fix: dma-buf: fence_chains_init: error unwind path leaks enable_sw_signaling reference

[PATCH] fix: dma-buf: fence_chains_init: error unwind path leaks enable_sw_signaling reference

[WenTao Liang]

dma_fence_enable_sw_signaling acquires an extra reference on each chain
  fence. The error unwind loop calls dma_fence_put only once per
  chain/fence without first signaling the fence to trigger the callback
  that releases the signaling reference. This prevents the chain fence kref
  from reaching 0, permanently leaking the chain and its contained fence.

Cc: stable@vger.kernel.org
Fixes: dc2f7e67a28a ("dma-buf: Exercise dma-fence-chain under selftests")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 drivers/dma-buf/st-dma-fence-chain.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/dma-buf/st-dma-fence-chain.c b/drivers/dma-buf/st-dma-fence-chain.c
index 821023dd34df..7dc18e294387 100644
--- a/drivers/dma-buf/st-dma-fence-chain.c
+++ b/drivers/dma-buf/st-dma-fence-chain.c
@@ -152,7 +152,10 @@ static int fence_chains_init(struct fence_chains *fc, unsigned int count,
 
 unwind:
 	for (i = 0; i < count; i++) {
-		dma_fence_put(fc->fences[i]);
+		if (fc->fences[i]) {
+			dma_fence_signal(fc->fences[i]);
+			dma_fence_put(fc->fences[i]);
+		}
 		dma_fence_put(fc->chains[i]);
 	}
 	kvfree(fc->fences);
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] fix: dma-buf: fence_chains_init: error unwind path leaks enable_sw_signaling reference

[Christian König]

On 6/26/26 14:18, WenTao Liang wrote:
> dma_fence_enable_sw_signaling acquires an extra reference on each chain
>   fence. The error unwind loop calls dma_fence_put only once per
>   chain/fence without first signaling the fence to trigger the callback
>   that releases the signaling reference. This prevents the chain fence kref
>   from reaching 0, permanently leaking the chain and its contained fence.
> 
> Cc: stable@vger.kernel.org
> Fixes: dc2f7e67a28a ("dma-buf: Exercise dma-fence-chain under selftests")

Please drop that, this is a minor issue in a unit test and not anything which needs backporting.

> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/dma-buf/st-dma-fence-chain.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/dma-buf/st-dma-fence-chain.c b/drivers/dma-buf/st-dma-fence-chain.c
> index 821023dd34df..7dc18e294387 100644
> --- a/drivers/dma-buf/st-dma-fence-chain.c
> +++ b/drivers/dma-buf/st-dma-fence-chain.c
> @@ -152,7 +152,10 @@ static int fence_chains_init(struct fence_chains *fc, unsigned int count,
>  
>  unwind:
>  	for (i = 0; i < count; i++) {
> -		dma_fence_put(fc->fences[i]);
> +		if (fc->fences[i]) {
> +			dma_fence_signal(fc->fences[i]);
> +			dma_fence_put(fc->fences[i]);
> +		}

The usual text book idiom for such cleanup cases is:

while (i--) {
	dma_fence_signal(fc->fences[i]);
	dma_fence_put(fc->chains[i]);
}

Additional to that we need a different error handling target for the case that the mock_chain() allocation fails (or just do another dma_fence_put there).

Regards,
Christian.

>  		dma_fence_put(fc->chains[i]);
>  	}
>  	kvfree(fc->fences);

Re: [PATCH] fix: dma-buf: fence_chains_init: error unwind path leaks enable_sw_signaling reference

[WenTao Liang]

> 2026年6月26日 20:18，WenTao Liang <vulab@iscas.ac.cn> 写道：
> 
> dma_fence_enable_sw_signaling acquires an extra reference on each chain
>  fence. The error unwind loop calls dma_fence_put only once per
>  chain/fence without first signaling the fence to trigger the callback
>  that releases the signaling reference. This prevents the chain fence kref
>  from reaching 0, permanently leaking the chain and its contained fence.
> 
> Cc: stable@vger.kernel.org
> Fixes: dc2f7e67a28a ("dma-buf: Exercise dma-fence-chain under selftests")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
> ---
> drivers/dma-buf/st-dma-fence-chain.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/dma-buf/st-dma-fence-chain.c b/drivers/dma-buf/st-dma-fence-chain.c
> index 821023dd34df..7dc18e294387 100644
> --- a/drivers/dma-buf/st-dma-fence-chain.c
> +++ b/drivers/dma-buf/st-dma-fence-chain.c
> @@ -152,7 +152,10 @@ static int fence_chains_init(struct fence_chains *fc, unsigned int count,
> 
> unwind:
> 	for (i = 0; i < count; i++) {
> -		dma_fence_put(fc->fences[i]);
> +		if (fc->fences[i]) {
> +			dma_fence_signal(fc->fences[i]);
> +			dma_fence_put(fc->fences[i]);
> +		}
> 		dma_fence_put(fc->chains[i]);
> 	}
> 	kvfree(fc->fences);
> -- 
> 2.39.5 (Apple Git-154)

Please ignore this patch. I will resend a proper version after
learning the kernel submission process.

Apologies for the noise.

Best regards,
WenTao Liang