2026年6月26日 20:33，Christian König <christian.koenig@amd.com> 写道：

On 6/26/26 14:18, WenTao Liang wrote:

dma_fence_enable_sw_signaling acquires an extra reference on each chain
 fence. The error unwind loop calls dma_fence_put only once per
 chain/fence without first signaling the fence to trigger the callback
 that releases the signaling reference. This prevents the chain fence kref
 from reaching 0, permanently leaking the chain and its contained fence.

Cc: stable@vger.kernel.org
Fixes: dc2f7e67a28a ("dma-buf: Exercise dma-fence-chain under selftests")

Please drop that, this is a minor issue in a unit test and not anything which needs backporting.

Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
drivers/dma-buf/st-dma-fence-chain.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/dma-buf/st-dma-fence-chain.c b/drivers/dma-buf/st-dma-fence-chain.c
index 821023dd34df..7dc18e294387 100644
--- a/drivers/dma-buf/st-dma-fence-chain.c
+++ b/drivers/dma-buf/st-dma-fence-chain.c
@@ -152,7 +152,10 @@ static int fence_chains_init(struct fence_chains *fc, unsigned int count,

unwind:
for (i = 0; i < count; i++) {
- dma_fence_put(fc->fences[i]);
+ if (fc->fences[i]) {
+ dma_fence_signal(fc->fences[i]);
+ dma_fence_put(fc->fences[i]);
+ }

The usual text book idiom for such cleanup cases is:

while (i--) {
dma_fence_signal(fc->fences[i]);
dma_fence_put(fc->chains[i]);
}

Additional to that we need a different error handling target for the case that the mock_chain() allocation fails (or just do another dma_fence_put there).

Regards,
Christian.

dma_fence_put(fc->chains[i]);
}
kvfree(fc->fences);