The success path only releases a2 via dma_fence_put but does not release a1, c1, or c2. The dma_fence_get calls at lines 440 and 445 were intended to pass references to mock_chain, but mock_chain already acquires its own references internally, making these extra gets surplus and permanently leaked.
Cc: stable@vger.kernel.org Fixes: b1cce631e61f ("dma-buf: add selftest for fence order after merge") Signed-off-by: WenTao Liang vulab@iscas.ac.cn --- drivers/dma-buf/st-dma-fence-unwrap.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/dma-buf/st-dma-fence-unwrap.c b/drivers/dma-buf/st-dma-fence-unwrap.c index 9c74195f47fd..72ca632e3981 100644 --- a/drivers/dma-buf/st-dma-fence-unwrap.c +++ b/drivers/dma-buf/st-dma-fence-unwrap.c @@ -472,6 +472,8 @@ static int unwrap_merge_order(void *arg) }
dma_fence_put(a2); + dma_fence_put(c2); + dma_fence_put(a1); return err;
error_put_a1: