Thanks for the review. I have sent v4 with a code comment explaining that the timeline lock serializes with timeline_fence_release(), keeping the sync point allocated while dma_fence_get_rcu() examines its reference count. The zero-reference case now leaves list and rb-tree removal to timeline_fence_release(), and the Fixes tag has been dropped.
Regards, Kirtikumar
