On 6/26/26 14:18, WenTao Liang wrote:

dma_fence_enable_sw_signaling acquires an extra reference on each chain fence. The error unwind loop calls dma_fence_put only once per chain/fence without first signaling the fence to trigger the callback that releases the signaling reference. This prevents the chain fence kref from reaching 0, permanently leaking the chain and its contained fence.

Cc: stable@vger.kernel.org Fixes: dc2f7e67a28a ("dma-buf: Exercise dma-fence-chain under selftests")

Please drop that, this is a minor issue in a unit test and not anything which needs backporting.

Signed-off-by: WenTao Liang vulab@iscas.ac.cn

drivers/dma-buf/st-dma-fence-chain.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/dma-buf/st-dma-fence-chain.c b/drivers/dma-buf/st-dma-fence-chain.c index 821023dd34df..7dc18e294387 100644 --- a/drivers/dma-buf/st-dma-fence-chain.c +++ b/drivers/dma-buf/st-dma-fence-chain.c @@ -152,7 +152,10 @@ static int fence_chains_init(struct fence_chains *fc, unsigned int count, unwind: for (i = 0; i < count; i++) {

• dma_fence_put(fc->fences[i]);
  

• if (fc->fences[i]) {
  

• 	dma_fence_signal(fc->fences[i]);
  

• 	dma_fence_put(fc->fences[i]);
  

• }
  

The usual text book idiom for such cleanup cases is:

while (i--) { dma_fence_signal(fc->fences[i]); dma_fence_put(fc->chains[i]); }

Additional to that we need a different error handling target for the case that the mock_chain() allocation fails (or just do another dma_fence_put there).

Regards, Christian.

dma_fence_put(fc->chains[i]);

} kvfree(fc->fences);