* drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195)
@ 2026-09-10 14:15 Dan Carpenter
2026-09-11 7:49 ` Christian König
0 siblings, 1 reply; 4+ messages in thread
From: Dan Carpenter @ 2026-09-10 14:15 UTC (permalink / raw)
To: oe-kbuild, Jason Gunthorpe
Cc: lkp, oe-kbuild-all, linux-kernel, Christian König
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 28924df2a08f440c73991b83028032c901de2ae4
commit: 6055c9e333cfbb5af3eabe204caea92757094d19 dma-buf: Change st-dma-fence-chain.c to use kunit
config: arm-randconfig-r071-20260908 (https://download.01.org/0day-ci/archive/20260908/202609081301.6ARYAElY-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 2362eeb5f75560740146975e9eabe84c6bd25a0d)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 6055c9e333cf ("dma-buf: Change st-dma-fence-chain.c to use kunit")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202609081301.6ARYAElY-lkp@intel.com/
New smatch warnings:
drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195)
drivers/dma-buf/st-dma-fence-chain.c:339 test_find_gap() error: dereferencing freed memory 'fence' (line 332)
Old smatch warnings:
drivers/dma-buf/st-dma-fence-chain.c:219 test_find_seqno() warn: passing freed memory 'fence' (line 209)
drivers/dma-buf/st-dma-fence-chain.c:228 test_find_seqno() warn: passing freed memory 'fence' (line 221)
drivers/dma-buf/st-dma-fence-chain.c:266 test_find_signaled() error: dereferencing freed memory 'fence' (line 259)
drivers/dma-buf/st-dma-fence-chain.c:307 test_find_out_of_order() error: dereferencing freed memory 'fence' (line 293)
drivers/dma-buf/st-dma-fence-chain.c:346 test_find_gap() warn: passing freed memory 'fence' (line 332)
vim +/fence +207 drivers/dma-buf/st-dma-fence-chain.c
6055c9e333cfbb Jason Gunthorpe 2026-03-01 174 static void test_find_seqno(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 175 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 176 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 177 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 178 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 179 int i;
dc2f7e67a28a5c Chris Wilson 2020-04-09 180
dc2f7e67a28a5c Chris Wilson 2020-04-09 181 err = fence_chains_init(&fc, 64, seqno_inc);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 182 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 183
dc2f7e67a28a5c Chris Wilson 2020-04-09 184 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 185 err = dma_fence_chain_find_seqno(&fence, 0);
dc2f7e67a28a5c Chris Wilson 2020-04-09 186 dma_fence_put(fence);
The zero day bot is warning about this code because it moved, but
calling dma_fence_put() and then calling dma_fence_get() doesn't
make much sense. Why even bother with refcounting it at that point
if we know it's unnecessary?
fence is the same as fc.tail...
I don't think there is any cleanup.h magic for dma fences?
dc2f7e67a28a5c Chris Wilson 2020-04-09 187 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 188 KUNIT_FAIL(test, "Reported %d for find_seqno(0)!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 189 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 190 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 191
dc2f7e67a28a5c Chris Wilson 2020-04-09 192 for (i = 0; i < fc.chain_length; i++) {
dc2f7e67a28a5c Chris Wilson 2020-04-09 193 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 194 err = dma_fence_chain_find_seqno(&fence, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 @195 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 196 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 197 KUNIT_FAIL(test, "Reported %d for find_seqno(%d:%d)!",
dc2f7e67a28a5c Chris Wilson 2020-04-09 198 err, fc.chain_length + 1, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 199 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 200 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 201 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 202 KUNIT_FAIL(test, "Incorrect fence reported by find_seqno(%d:%d)",
dc2f7e67a28a5c Chris Wilson 2020-04-09 203 fc.chain_length + 1, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 204 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 205 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 206
dc2f7e67a28a5c Chris Wilson 2020-04-09 @207 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 208 err = dma_fence_chain_find_seqno(&fence, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 209 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 210 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 211 KUNIT_FAIL(test, "Error reported for finding self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 212 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 213 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 214 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 215 KUNIT_FAIL(test, "Incorrect fence reported by find self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 216 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 217 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 218
dc2f7e67a28a5c Chris Wilson 2020-04-09 219 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 220 err = dma_fence_chain_find_seqno(&fence, i + 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 221 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 222 if (!err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 223 KUNIT_FAIL(test, "Error not reported for future fence: find_seqno(%d:%d)!",
dc2f7e67a28a5c Chris Wilson 2020-04-09 224 i + 1, i + 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 225 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 226 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 227
dc2f7e67a28a5c Chris Wilson 2020-04-09 228 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 229 err = dma_fence_chain_find_seqno(&fence, i);
dc2f7e67a28a5c Chris Wilson 2020-04-09 230 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 231 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 232 KUNIT_FAIL(test, "Error reported for previous fence!");
dc2f7e67a28a5c Chris Wilson 2020-04-09 233 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 234 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 235 if (i > 0 && fence != fc.chains[i - 1]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 236 KUNIT_FAIL(test, "Incorrect fence reported by find_seqno(%d:%d)",
dc2f7e67a28a5c Chris Wilson 2020-04-09 237 i + 1, i);
dc2f7e67a28a5c Chris Wilson 2020-04-09 238 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 239 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 240 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 241
dc2f7e67a28a5c Chris Wilson 2020-04-09 242 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 243 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 244 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 245
6055c9e333cfbb Jason Gunthorpe 2026-03-01 246 static void test_find_signaled(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 247 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 248 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 249 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 250 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 251
dc2f7e67a28a5c Chris Wilson 2020-04-09 252 err = fence_chains_init(&fc, 2, seqno_inc);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 253 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 254
dc2f7e67a28a5c Chris Wilson 2020-04-09 255 dma_fence_signal(fc.fences[0]);
dc2f7e67a28a5c Chris Wilson 2020-04-09 256
dc2f7e67a28a5c Chris Wilson 2020-04-09 257 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 258 err = dma_fence_chain_find_seqno(&fence, 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 259 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 260 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 261 KUNIT_FAIL(test, "Reported %d for find_seqno()!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 262 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 263 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 264
dc2f7e67a28a5c Chris Wilson 2020-04-09 265 if (fence && fence != fc.chains[0]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 266 KUNIT_FAIL(test, "Incorrect chain-fence.seqno:%lld reported for completed seqno:1",
dc2f7e67a28a5c Chris Wilson 2020-04-09 267 fence->seqno);
dc2f7e67a28a5c Chris Wilson 2020-04-09 268
dc2f7e67a28a5c Chris Wilson 2020-04-09 269 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 270 err = dma_fence_chain_find_seqno(&fence, 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 271 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 272 if (err)
6055c9e333cfbb Jason Gunthorpe 2026-03-01 273 KUNIT_FAIL(test, "Reported %d for finding self!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 274 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 275
dc2f7e67a28a5c Chris Wilson 2020-04-09 276 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 277 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 278 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 279
6055c9e333cfbb Jason Gunthorpe 2026-03-01 280 static void test_find_out_of_order(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 281 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 282 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 283 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 284 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 285
dc2f7e67a28a5c Chris Wilson 2020-04-09 286 err = fence_chains_init(&fc, 3, seqno_inc);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 287 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 288
dc2f7e67a28a5c Chris Wilson 2020-04-09 289 dma_fence_signal(fc.fences[1]);
dc2f7e67a28a5c Chris Wilson 2020-04-09 290
dc2f7e67a28a5c Chris Wilson 2020-04-09 291 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 292 err = dma_fence_chain_find_seqno(&fence, 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 293 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 294 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 295 KUNIT_FAIL(test, "Reported %d for find_seqno()!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 296 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 297 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 298
4cca2e64164176 Lionel Landwerlin 2020-06-25 299 /*
4cca2e64164176 Lionel Landwerlin 2020-06-25 300 * We signaled the middle fence (2) of the 1-2-3 chain. The behavior
4cca2e64164176 Lionel Landwerlin 2020-06-25 301 * of the dma-fence-chain is to make us wait for all the fences up to
4cca2e64164176 Lionel Landwerlin 2020-06-25 302 * the point we want. Since fence 1 is still not signaled, this what
4cca2e64164176 Lionel Landwerlin 2020-06-25 303 * we should get as fence to wait upon (fence 2 being garbage
4cca2e64164176 Lionel Landwerlin 2020-06-25 304 * collected during the traversal of the chain).
4cca2e64164176 Lionel Landwerlin 2020-06-25 305 */
6055c9e333cfbb Jason Gunthorpe 2026-03-01 306 if (fence != fc.chains[0])
6055c9e333cfbb Jason Gunthorpe 2026-03-01 307 KUNIT_FAIL(test, "Incorrect chain-fence.seqno:%lld reported for completed seqno:2",
4cca2e64164176 Lionel Landwerlin 2020-06-25 308 fence ? fence->seqno : 0);
dc2f7e67a28a5c Chris Wilson 2020-04-09 309
dc2f7e67a28a5c Chris Wilson 2020-04-09 310 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 311 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 312 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 313
dc2f7e67a28a5c Chris Wilson 2020-04-09 314 static uint64_t seqno_inc2(unsigned int i)
dc2f7e67a28a5c Chris Wilson 2020-04-09 315 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 316 return 2 * i + 2;
dc2f7e67a28a5c Chris Wilson 2020-04-09 317 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 318
6055c9e333cfbb Jason Gunthorpe 2026-03-01 319 static void test_find_gap(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 320 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 321 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 322 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 323 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 324 int i;
dc2f7e67a28a5c Chris Wilson 2020-04-09 325
dc2f7e67a28a5c Chris Wilson 2020-04-09 326 err = fence_chains_init(&fc, 64, seqno_inc2);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 327 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 328
dc2f7e67a28a5c Chris Wilson 2020-04-09 329 for (i = 0; i < fc.chain_length; i++) {
dc2f7e67a28a5c Chris Wilson 2020-04-09 330 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 331 err = dma_fence_chain_find_seqno(&fence, 2 * i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 @332 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 333 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 334 KUNIT_FAIL(test, "Reported %d for find_seqno(%d:%d)!",
dc2f7e67a28a5c Chris Wilson 2020-04-09 335 err, fc.chain_length + 1, 2 * i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 336 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 337 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 338 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 @339 KUNIT_FAIL(test, "Incorrect fence.seqno:%lld reported by find_seqno(%d:%d)",
dc2f7e67a28a5c Chris Wilson 2020-04-09 340 fence->seqno,
dc2f7e67a28a5c Chris Wilson 2020-04-09 341 fc.chain_length + 1,
dc2f7e67a28a5c Chris Wilson 2020-04-09 342 2 * i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 343 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 344 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 345
dc2f7e67a28a5c Chris Wilson 2020-04-09 346 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 347 err = dma_fence_chain_find_seqno(&fence, 2 * i + 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 348 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 349 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 350 KUNIT_FAIL(test, "Error reported for finding self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 351 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 352 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 353 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 354 KUNIT_FAIL(test, "Incorrect fence reported by find self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 355 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 356 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 357 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 358
dc2f7e67a28a5c Chris Wilson 2020-04-09 359 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 360 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 361 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 362
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195)
2026-09-10 14:15 drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195) Dan Carpenter
@ 2026-09-11 7:49 ` Christian König
2026-09-11 12:22 ` Dan Carpenter
0 siblings, 1 reply; 4+ messages in thread
From: Christian König @ 2026-09-11 7:49 UTC (permalink / raw)
To: Dan Carpenter, oe-kbuild, Jason Gunthorpe
Cc: lkp, oe-kbuild-all, linux-kernel
Hi Dan,
I just double check and this one and the other "warn: passing freed memory 'fence'" look like a false positive to me.
Any idea why smatch things that the memory is already freed in the test case?
Thanks,
Christian.
On 9/10/26 16:15, Dan Carpenter wrote:
> tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> head: 28924df2a08f440c73991b83028032c901de2ae4
> commit: 6055c9e333cfbb5af3eabe204caea92757094d19 dma-buf: Change st-dma-fence-chain.c to use kunit
> config: arm-randconfig-r071-20260908 (https://download.01.org/0day-ci/archive/20260908/202609081301.6ARYAElY-lkp@intel.com/config)
> compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 2362eeb5f75560740146975e9eabe84c6bd25a0d)
> smatch: v0.5.0-9187-g5189e3fb
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Fixes: 6055c9e333cf ("dma-buf: Change st-dma-fence-chain.c to use kunit")
> | Reported-by: kernel test robot <lkp@intel.com>
> | Reported-by: Dan Carpenter <error27@gmail.com>
> | Closes: https://lore.kernel.org/r/202609081301.6ARYAElY-lkp@intel.com/
>
> New smatch warnings:
> drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195)
> drivers/dma-buf/st-dma-fence-chain.c:339 test_find_gap() error: dereferencing freed memory 'fence' (line 332)
>
> Old smatch warnings:
> drivers/dma-buf/st-dma-fence-chain.c:219 test_find_seqno() warn: passing freed memory 'fence' (line 209)
> drivers/dma-buf/st-dma-fence-chain.c:228 test_find_seqno() warn: passing freed memory 'fence' (line 221)
> drivers/dma-buf/st-dma-fence-chain.c:266 test_find_signaled() error: dereferencing freed memory 'fence' (line 259)
> drivers/dma-buf/st-dma-fence-chain.c:307 test_find_out_of_order() error: dereferencing freed memory 'fence' (line 293)
> drivers/dma-buf/st-dma-fence-chain.c:346 test_find_gap() warn: passing freed memory 'fence' (line 332)
>
> vim +/fence +207 drivers/dma-buf/st-dma-fence-chain.c
>
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 174 static void test_find_seqno(struct kunit *test)
> dc2f7e67a28a5c Chris Wilson 2020-04-09 175 {
> dc2f7e67a28a5c Chris Wilson 2020-04-09 176 struct fence_chains fc;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 177 struct dma_fence *fence;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 178 int err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 179 int i;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 180
> dc2f7e67a28a5c Chris Wilson 2020-04-09 181 err = fence_chains_init(&fc, 64, seqno_inc);
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 182 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
> dc2f7e67a28a5c Chris Wilson 2020-04-09 183
> dc2f7e67a28a5c Chris Wilson 2020-04-09 184 fence = dma_fence_get(fc.tail);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 185 err = dma_fence_chain_find_seqno(&fence, 0);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 186 dma_fence_put(fence);
>
> The zero day bot is warning about this code because it moved, but
> calling dma_fence_put() and then calling dma_fence_get() doesn't
> make much sense. Why even bother with refcounting it at that point
> if we know it's unnecessary?
>
> fence is the same as fc.tail...
>
> I don't think there is any cleanup.h magic for dma fences?
>
> dc2f7e67a28a5c Chris Wilson 2020-04-09 187 if (err) {
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 188 KUNIT_FAIL(test, "Reported %d for find_seqno(0)!", err);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 189 goto err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 190 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 191
> dc2f7e67a28a5c Chris Wilson 2020-04-09 192 for (i = 0; i < fc.chain_length; i++) {
> dc2f7e67a28a5c Chris Wilson 2020-04-09 193 fence = dma_fence_get(fc.tail);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 194 err = dma_fence_chain_find_seqno(&fence, i + 1);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 @195 dma_fence_put(fence);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 196 if (err) {
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 197 KUNIT_FAIL(test, "Reported %d for find_seqno(%d:%d)!",
> dc2f7e67a28a5c Chris Wilson 2020-04-09 198 err, fc.chain_length + 1, i + 1);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 199 goto err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 200 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 201 if (fence != fc.chains[i]) {
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 202 KUNIT_FAIL(test, "Incorrect fence reported by find_seqno(%d:%d)",
> dc2f7e67a28a5c Chris Wilson 2020-04-09 203 fc.chain_length + 1, i + 1);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 204 goto err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 205 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 206
> dc2f7e67a28a5c Chris Wilson 2020-04-09 @207 dma_fence_get(fence);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 208 err = dma_fence_chain_find_seqno(&fence, i + 1);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 209 dma_fence_put(fence);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 210 if (err) {
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 211 KUNIT_FAIL(test, "Error reported for finding self");
> dc2f7e67a28a5c Chris Wilson 2020-04-09 212 goto err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 213 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 214 if (fence != fc.chains[i]) {
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 215 KUNIT_FAIL(test, "Incorrect fence reported by find self");
> dc2f7e67a28a5c Chris Wilson 2020-04-09 216 goto err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 217 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 218
> dc2f7e67a28a5c Chris Wilson 2020-04-09 219 dma_fence_get(fence);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 220 err = dma_fence_chain_find_seqno(&fence, i + 2);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 221 dma_fence_put(fence);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 222 if (!err) {
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 223 KUNIT_FAIL(test, "Error not reported for future fence: find_seqno(%d:%d)!",
> dc2f7e67a28a5c Chris Wilson 2020-04-09 224 i + 1, i + 2);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 225 goto err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 226 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 227
> dc2f7e67a28a5c Chris Wilson 2020-04-09 228 dma_fence_get(fence);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 229 err = dma_fence_chain_find_seqno(&fence, i);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 230 dma_fence_put(fence);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 231 if (err) {
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 232 KUNIT_FAIL(test, "Error reported for previous fence!");
> dc2f7e67a28a5c Chris Wilson 2020-04-09 233 goto err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 234 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 235 if (i > 0 && fence != fc.chains[i - 1]) {
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 236 KUNIT_FAIL(test, "Incorrect fence reported by find_seqno(%d:%d)",
> dc2f7e67a28a5c Chris Wilson 2020-04-09 237 i + 1, i);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 238 goto err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 239 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 240 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 241
> dc2f7e67a28a5c Chris Wilson 2020-04-09 242 err:
> dc2f7e67a28a5c Chris Wilson 2020-04-09 243 fence_chains_fini(&fc);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 244 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 245
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 246 static void test_find_signaled(struct kunit *test)
> dc2f7e67a28a5c Chris Wilson 2020-04-09 247 {
> dc2f7e67a28a5c Chris Wilson 2020-04-09 248 struct fence_chains fc;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 249 struct dma_fence *fence;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 250 int err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 251
> dc2f7e67a28a5c Chris Wilson 2020-04-09 252 err = fence_chains_init(&fc, 2, seqno_inc);
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 253 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
> dc2f7e67a28a5c Chris Wilson 2020-04-09 254
> dc2f7e67a28a5c Chris Wilson 2020-04-09 255 dma_fence_signal(fc.fences[0]);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 256
> dc2f7e67a28a5c Chris Wilson 2020-04-09 257 fence = dma_fence_get(fc.tail);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 258 err = dma_fence_chain_find_seqno(&fence, 1);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 259 dma_fence_put(fence);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 260 if (err) {
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 261 KUNIT_FAIL(test, "Reported %d for find_seqno()!", err);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 262 goto err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 263 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 264
> dc2f7e67a28a5c Chris Wilson 2020-04-09 265 if (fence && fence != fc.chains[0]) {
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 266 KUNIT_FAIL(test, "Incorrect chain-fence.seqno:%lld reported for completed seqno:1",
> dc2f7e67a28a5c Chris Wilson 2020-04-09 267 fence->seqno);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 268
> dc2f7e67a28a5c Chris Wilson 2020-04-09 269 dma_fence_get(fence);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 270 err = dma_fence_chain_find_seqno(&fence, 1);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 271 dma_fence_put(fence);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 272 if (err)
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 273 KUNIT_FAIL(test, "Reported %d for finding self!", err);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 274 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 275
> dc2f7e67a28a5c Chris Wilson 2020-04-09 276 err:
> dc2f7e67a28a5c Chris Wilson 2020-04-09 277 fence_chains_fini(&fc);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 278 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 279
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 280 static void test_find_out_of_order(struct kunit *test)
> dc2f7e67a28a5c Chris Wilson 2020-04-09 281 {
> dc2f7e67a28a5c Chris Wilson 2020-04-09 282 struct fence_chains fc;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 283 struct dma_fence *fence;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 284 int err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 285
> dc2f7e67a28a5c Chris Wilson 2020-04-09 286 err = fence_chains_init(&fc, 3, seqno_inc);
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 287 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
> dc2f7e67a28a5c Chris Wilson 2020-04-09 288
> dc2f7e67a28a5c Chris Wilson 2020-04-09 289 dma_fence_signal(fc.fences[1]);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 290
> dc2f7e67a28a5c Chris Wilson 2020-04-09 291 fence = dma_fence_get(fc.tail);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 292 err = dma_fence_chain_find_seqno(&fence, 2);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 293 dma_fence_put(fence);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 294 if (err) {
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 295 KUNIT_FAIL(test, "Reported %d for find_seqno()!", err);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 296 goto err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 297 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 298
> 4cca2e64164176 Lionel Landwerlin 2020-06-25 299 /*
> 4cca2e64164176 Lionel Landwerlin 2020-06-25 300 * We signaled the middle fence (2) of the 1-2-3 chain. The behavior
> 4cca2e64164176 Lionel Landwerlin 2020-06-25 301 * of the dma-fence-chain is to make us wait for all the fences up to
> 4cca2e64164176 Lionel Landwerlin 2020-06-25 302 * the point we want. Since fence 1 is still not signaled, this what
> 4cca2e64164176 Lionel Landwerlin 2020-06-25 303 * we should get as fence to wait upon (fence 2 being garbage
> 4cca2e64164176 Lionel Landwerlin 2020-06-25 304 * collected during the traversal of the chain).
> 4cca2e64164176 Lionel Landwerlin 2020-06-25 305 */
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 306 if (fence != fc.chains[0])
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 307 KUNIT_FAIL(test, "Incorrect chain-fence.seqno:%lld reported for completed seqno:2",
> 4cca2e64164176 Lionel Landwerlin 2020-06-25 308 fence ? fence->seqno : 0);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 309
> dc2f7e67a28a5c Chris Wilson 2020-04-09 310 err:
> dc2f7e67a28a5c Chris Wilson 2020-04-09 311 fence_chains_fini(&fc);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 312 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 313
> dc2f7e67a28a5c Chris Wilson 2020-04-09 314 static uint64_t seqno_inc2(unsigned int i)
> dc2f7e67a28a5c Chris Wilson 2020-04-09 315 {
> dc2f7e67a28a5c Chris Wilson 2020-04-09 316 return 2 * i + 2;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 317 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 318
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 319 static void test_find_gap(struct kunit *test)
> dc2f7e67a28a5c Chris Wilson 2020-04-09 320 {
> dc2f7e67a28a5c Chris Wilson 2020-04-09 321 struct fence_chains fc;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 322 struct dma_fence *fence;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 323 int err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 324 int i;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 325
> dc2f7e67a28a5c Chris Wilson 2020-04-09 326 err = fence_chains_init(&fc, 64, seqno_inc2);
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 327 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
> dc2f7e67a28a5c Chris Wilson 2020-04-09 328
> dc2f7e67a28a5c Chris Wilson 2020-04-09 329 for (i = 0; i < fc.chain_length; i++) {
> dc2f7e67a28a5c Chris Wilson 2020-04-09 330 fence = dma_fence_get(fc.tail);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 331 err = dma_fence_chain_find_seqno(&fence, 2 * i + 1);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 @332 dma_fence_put(fence);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 333 if (err) {
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 334 KUNIT_FAIL(test, "Reported %d for find_seqno(%d:%d)!",
> dc2f7e67a28a5c Chris Wilson 2020-04-09 335 err, fc.chain_length + 1, 2 * i + 1);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 336 goto err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 337 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 338 if (fence != fc.chains[i]) {
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 @339 KUNIT_FAIL(test, "Incorrect fence.seqno:%lld reported by find_seqno(%d:%d)",
> dc2f7e67a28a5c Chris Wilson 2020-04-09 340 fence->seqno,
> dc2f7e67a28a5c Chris Wilson 2020-04-09 341 fc.chain_length + 1,
> dc2f7e67a28a5c Chris Wilson 2020-04-09 342 2 * i + 1);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 343 goto err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 344 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 345
> dc2f7e67a28a5c Chris Wilson 2020-04-09 346 dma_fence_get(fence);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 347 err = dma_fence_chain_find_seqno(&fence, 2 * i + 2);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 348 dma_fence_put(fence);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 349 if (err) {
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 350 KUNIT_FAIL(test, "Error reported for finding self");
> dc2f7e67a28a5c Chris Wilson 2020-04-09 351 goto err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 352 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 353 if (fence != fc.chains[i]) {
> 6055c9e333cfbb Jason Gunthorpe 2026-03-01 354 KUNIT_FAIL(test, "Incorrect fence reported by find self");
> dc2f7e67a28a5c Chris Wilson 2020-04-09 355 goto err;
> dc2f7e67a28a5c Chris Wilson 2020-04-09 356 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 357 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 358
> dc2f7e67a28a5c Chris Wilson 2020-04-09 359 err:
> dc2f7e67a28a5c Chris Wilson 2020-04-09 360 fence_chains_fini(&fc);
> dc2f7e67a28a5c Chris Wilson 2020-04-09 361 }
> dc2f7e67a28a5c Chris Wilson 2020-04-09 362
>
> --
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195)
2026-09-11 7:49 ` Christian König
@ 2026-09-11 12:22 ` Dan Carpenter
2026-09-11 16:26 ` Christian König
0 siblings, 1 reply; 4+ messages in thread
From: Dan Carpenter @ 2026-09-11 12:22 UTC (permalink / raw)
To: Christian König
Cc: oe-kbuild, Jason Gunthorpe, lkp, oe-kbuild-all, linux-kernel
On Fri, Sep 11, 2026 at 09:49:54AM +0200, Christian König wrote:
> Hi Dan,
>
> I just double check and this one and the other "warn: passing freed memory 'fence'" look like a false positive to me.
>
> Any idea why smatch things that the memory is already freed in the test case?
dma_fence_put() can free the fence if we drop the last reference.
Or imagine that we aren't holding the last reference and a different
thread is holding it and they could call dma_fence_put() which is
also a use after free.
Incrementing then decrementing then incrementing the reference
count doesn't make any sense. We are relying on something else
to hold the reference. If we can rely on that, then we don't
need to increment and decrement the reference count for certain
basically random places.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195)
2026-09-11 12:22 ` Dan Carpenter
@ 2026-09-11 16:26 ` Christian König
0 siblings, 0 replies; 4+ messages in thread
From: Christian König @ 2026-09-11 16:26 UTC (permalink / raw)
To: Dan Carpenter
Cc: oe-kbuild, Jason Gunthorpe, lkp, oe-kbuild-all, linux-kernel
On 9/11/26 14:22, Dan Carpenter wrote:
> On Fri, Sep 11, 2026 at 09:49:54AM +0200, Christian König wrote:
>> Hi Dan,
>>
>> I just double check and this one and the other "warn: passing freed memory 'fence'" look like a false positive to me.
>>
>> Any idea why smatch things that the memory is already freed in the test case?
>
> dma_fence_put() can free the fence if we drop the last reference.
> Or imagine that we aren't holding the last reference and a different
> thread is holding it and they could call dma_fence_put() which is
> also a use after free.
>
> Incrementing then decrementing then incrementing the reference
> count doesn't make any sense. We are relying on something else
> to hold the reference. If we can rely on that, then we don't
> need to increment and decrement the reference count for certain
> basically random places.
Ok, well then that indeed seems to be a false positive from smatch.
The pattern is this:
get(fence);
make_fence_point_to_something_different(&fence);
put(fence);
The make_fence_point_to_something_different() function consumes the original fence reference and returns a new one. So the get/put dance is completely correct. (Well it indeed doesn't make much sense, normally you would do something with the returned reference before calling put. But that here is just to test the make_fence_point_to_something_different() function).
Regards,
Christian.
>
> regards,
> dan carpenter
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-11 16:27 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-10 14:15 drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195) Dan Carpenter
2026-09-11 7:49 ` Christian König
2026-09-11 12:22 ` Dan Carpenter
2026-09-11 16:26 ` Christian König
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®