On 6/26/26 14:28, WenTao Liang wrote:

dma_fence_get_stub() acquires an extra reference on the global stub fence, but this reference is never released on any execution path. The stub fence is filtered out inside dma_fence_unwrap_merge (already signaled), so the extra reference is never consumed. Both success and error paths fail to call dma_fence_put on the stub.

Cc: stable@vger.kernel.org Fixes: 245a4a7b531c ("dma-buf: generalize dma_fence unwrap & merging v3")

Just drop that, the stub fence is a global dummy and leaking reference to it is harmless.

But just in case somebody uses this code as blueprint for this own implementation we should probably clean it up.

Signed-off-by: WenTao Liang vulab@iscas.ac.cn

Reviewed-by: Christian König christian.koenig@amd.com

---

drivers/dma-buf/st-dma-fence-unwrap.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/dma-buf/st-dma-fence-unwrap.c b/drivers/dma-buf/st-dma-fence-unwrap.c index 72ca632e3981..b9ed85570211 100644 --- a/drivers/dma-buf/st-dma-fence-unwrap.c +++ b/drivers/dma-buf/st-dma-fence-unwrap.c @@ -483,7 +483,7 @@ static int unwrap_merge_order(void *arg) static int unwrap_merge_complex(void *arg) {

• struct dma_fence *fence, *f1, *f2, *f3, *f4, *f5;

• struct dma_fence *fence, *f1, *f2, *f3, *f4, *f5, *stub; struct dma_fence_unwrap iter; int err = -ENOMEM;

@@ -508,10 +508,11 @@ static int unwrap_merge_complex(void *arg) if (!f4) goto error_put_f3;

• stub = dma_fence_get_stub(); /* Signaled fences should be filtered, the two arrays merged. */

• f5 = dma_fence_unwrap_merge(f3, f4, dma_fence_get_stub());

• f5 = dma_fence_unwrap_merge(f3, f4, stub); if (!f5)

• goto error_put_f4;
  

• goto error_put_stub;
  

err = 0; dma_fence_unwrap_for_each(fence, &iter, f5) { @@ -532,8 +533,10 @@ static int unwrap_merge_complex(void *arg) err = -EINVAL; }

• dma_fence_put(stub); dma_fence_put(f5);

-error_put_f4: +error_put_stub:

• dma_fence_put(stub); dma_fence_put(f4);

error_put_f3: dma_fence_put(f3);