dma_fence_enable_sw_signaling acquires an extra reference on each chain fence. The error unwind loop calls dma_fence_put only once per chain/fence without first signaling the fence to trigger the callback that releases the signaling reference. This prevents the chain fence kref from reaching 0, permanently leaking the chain and its contained fence.
Cc: [email protected] Fixes: dc2f7e67a28a ("dma-buf: Exercise dma-fence-chain under selftests") Signed-off-by: WenTao Liang <[email protected]> --- drivers/dma-buf/st-dma-fence-chain.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/dma-buf/st-dma-fence-chain.c b/drivers/dma-buf/st-dma-fence-chain.c index 821023dd34df..7dc18e294387 100644 --- a/drivers/dma-buf/st-dma-fence-chain.c +++ b/drivers/dma-buf/st-dma-fence-chain.c @@ -152,7 +152,10 @@ static int fence_chains_init(struct fence_chains *fc, unsigned int count, unwind: for (i = 0; i < count; i++) { - dma_fence_put(fc->fences[i]); + if (fc->fences[i]) { + dma_fence_signal(fc->fences[i]); + dma_fence_put(fc->fences[i]); + } dma_fence_put(fc->chains[i]); } kvfree(fc->fences); -- 2.39.5 (Apple Git-154)
