+Cc André
On Thu, 2026-06-25 at 22:12 +0800, Baineng Shou wrote:
dma_fence_timeline_name() incorrectly invokes ops->get_driver_name() instead of ops->get_timeline_name(), so every caller receives the driver name where the timeline name was expected.
This is a copy-paste regression that has resurfaced twice. It was originally introduced by commit 62918542b7bf ("dma-fence: Fix sparse warnings due __rcu annotations") when adding the __rcu casts, fixed by commit 033559473dd3 ("dma-fence: Fix safe access wrapper to call timeline name method"), and then accidentally reintroduced by commit e58b4dea9054 ("dma-buf/dma-fence: Add dma_fence_test_signaled_flag()") when both wrappers were refactored to use the new helper.
Signed-off-by: Baineng Shou shoubaineng@gmail.com
André has caught this a few days ago already:
https://lore.kernel.org/dri-devel/20260618-linux-drm_crtc_fix-v1-1-801f29c98...
To save my honor I want to state that e58b4dea9054 did not actually *do this* change. But merging it must have caused it somehow, since that commit was still based on the old bug. I guess somewhere in conflict resolution somehow tho old code must have entered.
P.
drivers/dma-buf/dma-fence.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c index b3bfa6943a8e..5292d714419b 100644 --- a/drivers/dma-buf/dma-fence.c +++ b/drivers/dma-buf/dma-fence.c @@ -1202,7 +1202,7 @@ const char __rcu *dma_fence_timeline_name(struct dma_fence *fence) /* RCU protection is required for safe access to returned string */ ops = rcu_dereference(fence->ops); if (!dma_fence_test_signaled_flag(fence))
return (const char __rcu *)ops->get_driver_name(fence);
return (const char __rcu *)ops->get_timeline_name(fence);else return (const char __rcu *)"signaled-timeline"; }