On 11/5/26 15:26, Kirtikumar Anandrao Ramchandani wrote:

The last dma_fence_put() can drop a sync point's reference count to zero before timeline_fence_release() acquires the timeline lock. If sync_timeline_signal() takes the lock in that window, dma_fence_get() attempts to increment a zero reference count.

Use dma_fence_get_rcu() for the temporary signaling reference and skip a point whose reference count has reached zero. The timeline lock serializes with timeline_fence_release(), keeping the point allocated while its reference count is examined. The release callback removes the point from the list and tree after acquiring the lock.

For a live point, retain the temporary reference until after dropping the lock, avoiding recursive locking through signaling callbacks.

Reported-by: syzbot+cba1a1f459230395a076@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cba1a1f459230395a076 Signed-off-by: Kirtikumar Anandrao Ramchandani kirtiar15502@gmail.com

Reviewed-by: Christian König christian.koenig@amd.com

I will push this to drm-misc-next soon.

Thanks, Christian.

---

Changes in v4:

• Document why the timeline lock makes the conditional reference acquisition safe without an RCU read-side critical section.
• Leave list and rb-tree removal to timeline_fence_release().
• Drop the Fixes tag because SW_SYNC fixes are not intended for stable.

Changes in v3:

• Unlink zero-reference points from both indexes while holding the timeline lock.

drivers/dma-buf/sw_sync.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c index 8df20b021..8aa3ed777 100644 --- a/drivers/dma-buf/sw_sync.c +++ b/drivers/dma-buf/sw_sync.c @@ -221,7 +221,12 @@ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc) if (!timeline_fence_signaled(&pt->base)) break;

•           dma_fence_get(&pt->base);
  

•           /*
  

•            * The timeline lock prevents timeline_fence_release() from
  

•            * removing and freeing pt while its reference count is examined.
  

•            */
  

•           if (!dma_fence_get_rcu(&pt->base))
  

•                   continue;
  
            list_move_tail(&pt->link, &signalled);
            rb_erase(&pt->node, &obj->pt_tree);
  
  

base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d