From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195)
Date: Tue, 08 Sep 2026 14:06:27 +0800 [thread overview]
Message-ID: <202609081301.6ARYAElY-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Jason Gunthorpe <jgg@nvidia.com>
CC: "Christian König" <christian.koenig@amd.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 28924df2a08f440c73991b83028032c901de2ae4
commit: 6055c9e333cfbb5af3eabe204caea92757094d19 dma-buf: Change st-dma-fence-chain.c to use kunit
date: 5 months ago
:::::: branch date: 13 hours ago
:::::: commit date: 5 months ago
config: arm-randconfig-r071-20260908 (https://download.01.org/0day-ci/archive/20260908/202609081301.6ARYAElY-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 2362eeb5f75560740146975e9eabe84c6bd25a0d)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 6055c9e333cf ("dma-buf: Change st-dma-fence-chain.c to use kunit")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202609081301.6ARYAElY-lkp@intel.com/
New smatch warnings:
drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195)
drivers/dma-buf/st-dma-fence-chain.c:339 test_find_gap() error: dereferencing freed memory 'fence' (line 332)
Old smatch warnings:
drivers/dma-buf/st-dma-fence-chain.c:219 test_find_seqno() warn: passing freed memory 'fence' (line 209)
drivers/dma-buf/st-dma-fence-chain.c:228 test_find_seqno() warn: passing freed memory 'fence' (line 221)
drivers/dma-buf/st-dma-fence-chain.c:266 test_find_signaled() error: dereferencing freed memory 'fence' (line 259)
drivers/dma-buf/st-dma-fence-chain.c:307 test_find_out_of_order() error: dereferencing freed memory 'fence' (line 293)
drivers/dma-buf/st-dma-fence-chain.c:346 test_find_gap() warn: passing freed memory 'fence' (line 332)
vim +/fence +207 drivers/dma-buf/st-dma-fence-chain.c
dc2f7e67a28a5c Chris Wilson 2020-04-09 173
6055c9e333cfbb Jason Gunthorpe 2026-03-01 174 static void test_find_seqno(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 175 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 176 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 177 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 178 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 179 int i;
dc2f7e67a28a5c Chris Wilson 2020-04-09 180
dc2f7e67a28a5c Chris Wilson 2020-04-09 181 err = fence_chains_init(&fc, 64, seqno_inc);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 182 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 183
dc2f7e67a28a5c Chris Wilson 2020-04-09 184 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 185 err = dma_fence_chain_find_seqno(&fence, 0);
dc2f7e67a28a5c Chris Wilson 2020-04-09 186 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 187 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 188 KUNIT_FAIL(test, "Reported %d for find_seqno(0)!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 189 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 190 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 191
dc2f7e67a28a5c Chris Wilson 2020-04-09 192 for (i = 0; i < fc.chain_length; i++) {
dc2f7e67a28a5c Chris Wilson 2020-04-09 193 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 194 err = dma_fence_chain_find_seqno(&fence, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 @195 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 196 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 197 KUNIT_FAIL(test, "Reported %d for find_seqno(%d:%d)!",
dc2f7e67a28a5c Chris Wilson 2020-04-09 198 err, fc.chain_length + 1, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 199 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 200 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 201 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 202 KUNIT_FAIL(test, "Incorrect fence reported by find_seqno(%d:%d)",
dc2f7e67a28a5c Chris Wilson 2020-04-09 203 fc.chain_length + 1, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 204 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 205 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 206
dc2f7e67a28a5c Chris Wilson 2020-04-09 @207 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 208 err = dma_fence_chain_find_seqno(&fence, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 209 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 210 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 211 KUNIT_FAIL(test, "Error reported for finding self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 212 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 213 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 214 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 215 KUNIT_FAIL(test, "Incorrect fence reported by find self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 216 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 217 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 218
dc2f7e67a28a5c Chris Wilson 2020-04-09 219 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 220 err = dma_fence_chain_find_seqno(&fence, i + 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 221 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 222 if (!err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 223 KUNIT_FAIL(test, "Error not reported for future fence: find_seqno(%d:%d)!",
dc2f7e67a28a5c Chris Wilson 2020-04-09 224 i + 1, i + 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 225 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 226 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 227
dc2f7e67a28a5c Chris Wilson 2020-04-09 228 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 229 err = dma_fence_chain_find_seqno(&fence, i);
dc2f7e67a28a5c Chris Wilson 2020-04-09 230 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 231 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 232 KUNIT_FAIL(test, "Error reported for previous fence!");
dc2f7e67a28a5c Chris Wilson 2020-04-09 233 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 234 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 235 if (i > 0 && fence != fc.chains[i - 1]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 236 KUNIT_FAIL(test, "Incorrect fence reported by find_seqno(%d:%d)",
dc2f7e67a28a5c Chris Wilson 2020-04-09 237 i + 1, i);
dc2f7e67a28a5c Chris Wilson 2020-04-09 238 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 239 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 240 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 241
dc2f7e67a28a5c Chris Wilson 2020-04-09 242 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 243 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 244 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 245
6055c9e333cfbb Jason Gunthorpe 2026-03-01 246 static void test_find_signaled(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 247 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 248 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 249 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 250 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 251
dc2f7e67a28a5c Chris Wilson 2020-04-09 252 err = fence_chains_init(&fc, 2, seqno_inc);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 253 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 254
dc2f7e67a28a5c Chris Wilson 2020-04-09 255 dma_fence_signal(fc.fences[0]);
dc2f7e67a28a5c Chris Wilson 2020-04-09 256
dc2f7e67a28a5c Chris Wilson 2020-04-09 257 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 258 err = dma_fence_chain_find_seqno(&fence, 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 259 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 260 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 261 KUNIT_FAIL(test, "Reported %d for find_seqno()!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 262 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 263 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 264
dc2f7e67a28a5c Chris Wilson 2020-04-09 265 if (fence && fence != fc.chains[0]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 266 KUNIT_FAIL(test, "Incorrect chain-fence.seqno:%lld reported for completed seqno:1",
dc2f7e67a28a5c Chris Wilson 2020-04-09 267 fence->seqno);
dc2f7e67a28a5c Chris Wilson 2020-04-09 268
dc2f7e67a28a5c Chris Wilson 2020-04-09 269 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 270 err = dma_fence_chain_find_seqno(&fence, 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 271 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 272 if (err)
6055c9e333cfbb Jason Gunthorpe 2026-03-01 273 KUNIT_FAIL(test, "Reported %d for finding self!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 274 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 275
dc2f7e67a28a5c Chris Wilson 2020-04-09 276 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 277 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 278 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 279
6055c9e333cfbb Jason Gunthorpe 2026-03-01 280 static void test_find_out_of_order(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 281 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 282 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 283 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 284 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 285
dc2f7e67a28a5c Chris Wilson 2020-04-09 286 err = fence_chains_init(&fc, 3, seqno_inc);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 287 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 288
dc2f7e67a28a5c Chris Wilson 2020-04-09 289 dma_fence_signal(fc.fences[1]);
dc2f7e67a28a5c Chris Wilson 2020-04-09 290
dc2f7e67a28a5c Chris Wilson 2020-04-09 291 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 292 err = dma_fence_chain_find_seqno(&fence, 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 293 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 294 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 295 KUNIT_FAIL(test, "Reported %d for find_seqno()!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 296 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 297 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 298
4cca2e64164176 Lionel Landwerlin 2020-06-25 299 /*
4cca2e64164176 Lionel Landwerlin 2020-06-25 300 * We signaled the middle fence (2) of the 1-2-3 chain. The behavior
4cca2e64164176 Lionel Landwerlin 2020-06-25 301 * of the dma-fence-chain is to make us wait for all the fences up to
4cca2e64164176 Lionel Landwerlin 2020-06-25 302 * the point we want. Since fence 1 is still not signaled, this what
4cca2e64164176 Lionel Landwerlin 2020-06-25 303 * we should get as fence to wait upon (fence 2 being garbage
4cca2e64164176 Lionel Landwerlin 2020-06-25 304 * collected during the traversal of the chain).
4cca2e64164176 Lionel Landwerlin 2020-06-25 305 */
6055c9e333cfbb Jason Gunthorpe 2026-03-01 306 if (fence != fc.chains[0])
6055c9e333cfbb Jason Gunthorpe 2026-03-01 307 KUNIT_FAIL(test, "Incorrect chain-fence.seqno:%lld reported for completed seqno:2",
4cca2e64164176 Lionel Landwerlin 2020-06-25 308 fence ? fence->seqno : 0);
dc2f7e67a28a5c Chris Wilson 2020-04-09 309
dc2f7e67a28a5c Chris Wilson 2020-04-09 310 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 311 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 312 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 313
dc2f7e67a28a5c Chris Wilson 2020-04-09 314 static uint64_t seqno_inc2(unsigned int i)
dc2f7e67a28a5c Chris Wilson 2020-04-09 315 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 316 return 2 * i + 2;
dc2f7e67a28a5c Chris Wilson 2020-04-09 317 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 318
6055c9e333cfbb Jason Gunthorpe 2026-03-01 319 static void test_find_gap(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 320 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 321 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 322 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 323 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 324 int i;
dc2f7e67a28a5c Chris Wilson 2020-04-09 325
dc2f7e67a28a5c Chris Wilson 2020-04-09 326 err = fence_chains_init(&fc, 64, seqno_inc2);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 327 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 328
dc2f7e67a28a5c Chris Wilson 2020-04-09 329 for (i = 0; i < fc.chain_length; i++) {
dc2f7e67a28a5c Chris Wilson 2020-04-09 330 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 331 err = dma_fence_chain_find_seqno(&fence, 2 * i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 @332 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 333 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 334 KUNIT_FAIL(test, "Reported %d for find_seqno(%d:%d)!",
dc2f7e67a28a5c Chris Wilson 2020-04-09 335 err, fc.chain_length + 1, 2 * i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 336 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 337 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 338 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 @339 KUNIT_FAIL(test, "Incorrect fence.seqno:%lld reported by find_seqno(%d:%d)",
dc2f7e67a28a5c Chris Wilson 2020-04-09 340 fence->seqno,
dc2f7e67a28a5c Chris Wilson 2020-04-09 341 fc.chain_length + 1,
dc2f7e67a28a5c Chris Wilson 2020-04-09 342 2 * i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 343 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 344 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 345
dc2f7e67a28a5c Chris Wilson 2020-04-09 346 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 347 err = dma_fence_chain_find_seqno(&fence, 2 * i + 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 348 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 349 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 350 KUNIT_FAIL(test, "Error reported for finding self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 351 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 352 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 353 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 354 KUNIT_FAIL(test, "Incorrect fence reported by find self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 355 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 356 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 357 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 358
dc2f7e67a28a5c Chris Wilson 2020-04-09 359 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 360 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 361 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 362
:::::: The code at line 207 was first introduced by commit
:::::: dc2f7e67a28a5cbe4ea905dafaa6903df670014a dma-buf: Exercise dma-fence-chain under selftests
:::::: TO: Chris Wilson <chris@chris-wilson.co.uk>
:::::: CC: Chris Wilson <chris@chris-wilson.co.uk>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <error27@gmail.com>
To: oe-kbuild@lists.linux.dev, Jason Gunthorpe <jgg@nvidia.com>
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev,
linux-kernel@vger.kernel.org,
"Christian König" <christian.koenig@amd.com>
Subject: drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195)
Date: Thu, 10 Sep 2026 17:15:00 +0300 [thread overview]
Message-ID: <202609081301.6ARYAElY-lkp@intel.com> (raw)
Message-ID: <20260910141500.WR_49sgzebAMLsOLQFEEcDXTIXyce2qMbu5yLSRSd5M@z> (raw)
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 28924df2a08f440c73991b83028032c901de2ae4
commit: 6055c9e333cfbb5af3eabe204caea92757094d19 dma-buf: Change st-dma-fence-chain.c to use kunit
config: arm-randconfig-r071-20260908 (https://download.01.org/0day-ci/archive/20260908/202609081301.6ARYAElY-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 2362eeb5f75560740146975e9eabe84c6bd25a0d)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 6055c9e333cf ("dma-buf: Change st-dma-fence-chain.c to use kunit")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202609081301.6ARYAElY-lkp@intel.com/
New smatch warnings:
drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195)
drivers/dma-buf/st-dma-fence-chain.c:339 test_find_gap() error: dereferencing freed memory 'fence' (line 332)
Old smatch warnings:
drivers/dma-buf/st-dma-fence-chain.c:219 test_find_seqno() warn: passing freed memory 'fence' (line 209)
drivers/dma-buf/st-dma-fence-chain.c:228 test_find_seqno() warn: passing freed memory 'fence' (line 221)
drivers/dma-buf/st-dma-fence-chain.c:266 test_find_signaled() error: dereferencing freed memory 'fence' (line 259)
drivers/dma-buf/st-dma-fence-chain.c:307 test_find_out_of_order() error: dereferencing freed memory 'fence' (line 293)
drivers/dma-buf/st-dma-fence-chain.c:346 test_find_gap() warn: passing freed memory 'fence' (line 332)
vim +/fence +207 drivers/dma-buf/st-dma-fence-chain.c
6055c9e333cfbb Jason Gunthorpe 2026-03-01 174 static void test_find_seqno(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 175 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 176 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 177 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 178 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 179 int i;
dc2f7e67a28a5c Chris Wilson 2020-04-09 180
dc2f7e67a28a5c Chris Wilson 2020-04-09 181 err = fence_chains_init(&fc, 64, seqno_inc);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 182 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 183
dc2f7e67a28a5c Chris Wilson 2020-04-09 184 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 185 err = dma_fence_chain_find_seqno(&fence, 0);
dc2f7e67a28a5c Chris Wilson 2020-04-09 186 dma_fence_put(fence);
The zero day bot is warning about this code because it moved, but
calling dma_fence_put() and then calling dma_fence_get() doesn't
make much sense. Why even bother with refcounting it at that point
if we know it's unnecessary?
fence is the same as fc.tail...
I don't think there is any cleanup.h magic for dma fences?
dc2f7e67a28a5c Chris Wilson 2020-04-09 187 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 188 KUNIT_FAIL(test, "Reported %d for find_seqno(0)!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 189 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 190 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 191
dc2f7e67a28a5c Chris Wilson 2020-04-09 192 for (i = 0; i < fc.chain_length; i++) {
dc2f7e67a28a5c Chris Wilson 2020-04-09 193 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 194 err = dma_fence_chain_find_seqno(&fence, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 @195 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 196 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 197 KUNIT_FAIL(test, "Reported %d for find_seqno(%d:%d)!",
dc2f7e67a28a5c Chris Wilson 2020-04-09 198 err, fc.chain_length + 1, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 199 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 200 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 201 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 202 KUNIT_FAIL(test, "Incorrect fence reported by find_seqno(%d:%d)",
dc2f7e67a28a5c Chris Wilson 2020-04-09 203 fc.chain_length + 1, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 204 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 205 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 206
dc2f7e67a28a5c Chris Wilson 2020-04-09 @207 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 208 err = dma_fence_chain_find_seqno(&fence, i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 209 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 210 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 211 KUNIT_FAIL(test, "Error reported for finding self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 212 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 213 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 214 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 215 KUNIT_FAIL(test, "Incorrect fence reported by find self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 216 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 217 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 218
dc2f7e67a28a5c Chris Wilson 2020-04-09 219 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 220 err = dma_fence_chain_find_seqno(&fence, i + 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 221 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 222 if (!err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 223 KUNIT_FAIL(test, "Error not reported for future fence: find_seqno(%d:%d)!",
dc2f7e67a28a5c Chris Wilson 2020-04-09 224 i + 1, i + 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 225 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 226 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 227
dc2f7e67a28a5c Chris Wilson 2020-04-09 228 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 229 err = dma_fence_chain_find_seqno(&fence, i);
dc2f7e67a28a5c Chris Wilson 2020-04-09 230 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 231 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 232 KUNIT_FAIL(test, "Error reported for previous fence!");
dc2f7e67a28a5c Chris Wilson 2020-04-09 233 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 234 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 235 if (i > 0 && fence != fc.chains[i - 1]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 236 KUNIT_FAIL(test, "Incorrect fence reported by find_seqno(%d:%d)",
dc2f7e67a28a5c Chris Wilson 2020-04-09 237 i + 1, i);
dc2f7e67a28a5c Chris Wilson 2020-04-09 238 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 239 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 240 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 241
dc2f7e67a28a5c Chris Wilson 2020-04-09 242 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 243 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 244 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 245
6055c9e333cfbb Jason Gunthorpe 2026-03-01 246 static void test_find_signaled(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 247 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 248 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 249 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 250 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 251
dc2f7e67a28a5c Chris Wilson 2020-04-09 252 err = fence_chains_init(&fc, 2, seqno_inc);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 253 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 254
dc2f7e67a28a5c Chris Wilson 2020-04-09 255 dma_fence_signal(fc.fences[0]);
dc2f7e67a28a5c Chris Wilson 2020-04-09 256
dc2f7e67a28a5c Chris Wilson 2020-04-09 257 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 258 err = dma_fence_chain_find_seqno(&fence, 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 259 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 260 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 261 KUNIT_FAIL(test, "Reported %d for find_seqno()!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 262 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 263 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 264
dc2f7e67a28a5c Chris Wilson 2020-04-09 265 if (fence && fence != fc.chains[0]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 266 KUNIT_FAIL(test, "Incorrect chain-fence.seqno:%lld reported for completed seqno:1",
dc2f7e67a28a5c Chris Wilson 2020-04-09 267 fence->seqno);
dc2f7e67a28a5c Chris Wilson 2020-04-09 268
dc2f7e67a28a5c Chris Wilson 2020-04-09 269 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 270 err = dma_fence_chain_find_seqno(&fence, 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 271 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 272 if (err)
6055c9e333cfbb Jason Gunthorpe 2026-03-01 273 KUNIT_FAIL(test, "Reported %d for finding self!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 274 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 275
dc2f7e67a28a5c Chris Wilson 2020-04-09 276 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 277 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 278 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 279
6055c9e333cfbb Jason Gunthorpe 2026-03-01 280 static void test_find_out_of_order(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 281 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 282 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 283 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 284 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 285
dc2f7e67a28a5c Chris Wilson 2020-04-09 286 err = fence_chains_init(&fc, 3, seqno_inc);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 287 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 288
dc2f7e67a28a5c Chris Wilson 2020-04-09 289 dma_fence_signal(fc.fences[1]);
dc2f7e67a28a5c Chris Wilson 2020-04-09 290
dc2f7e67a28a5c Chris Wilson 2020-04-09 291 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 292 err = dma_fence_chain_find_seqno(&fence, 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 293 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 294 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 295 KUNIT_FAIL(test, "Reported %d for find_seqno()!", err);
dc2f7e67a28a5c Chris Wilson 2020-04-09 296 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 297 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 298
4cca2e64164176 Lionel Landwerlin 2020-06-25 299 /*
4cca2e64164176 Lionel Landwerlin 2020-06-25 300 * We signaled the middle fence (2) of the 1-2-3 chain. The behavior
4cca2e64164176 Lionel Landwerlin 2020-06-25 301 * of the dma-fence-chain is to make us wait for all the fences up to
4cca2e64164176 Lionel Landwerlin 2020-06-25 302 * the point we want. Since fence 1 is still not signaled, this what
4cca2e64164176 Lionel Landwerlin 2020-06-25 303 * we should get as fence to wait upon (fence 2 being garbage
4cca2e64164176 Lionel Landwerlin 2020-06-25 304 * collected during the traversal of the chain).
4cca2e64164176 Lionel Landwerlin 2020-06-25 305 */
6055c9e333cfbb Jason Gunthorpe 2026-03-01 306 if (fence != fc.chains[0])
6055c9e333cfbb Jason Gunthorpe 2026-03-01 307 KUNIT_FAIL(test, "Incorrect chain-fence.seqno:%lld reported for completed seqno:2",
4cca2e64164176 Lionel Landwerlin 2020-06-25 308 fence ? fence->seqno : 0);
dc2f7e67a28a5c Chris Wilson 2020-04-09 309
dc2f7e67a28a5c Chris Wilson 2020-04-09 310 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 311 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 312 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 313
dc2f7e67a28a5c Chris Wilson 2020-04-09 314 static uint64_t seqno_inc2(unsigned int i)
dc2f7e67a28a5c Chris Wilson 2020-04-09 315 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 316 return 2 * i + 2;
dc2f7e67a28a5c Chris Wilson 2020-04-09 317 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 318
6055c9e333cfbb Jason Gunthorpe 2026-03-01 319 static void test_find_gap(struct kunit *test)
dc2f7e67a28a5c Chris Wilson 2020-04-09 320 {
dc2f7e67a28a5c Chris Wilson 2020-04-09 321 struct fence_chains fc;
dc2f7e67a28a5c Chris Wilson 2020-04-09 322 struct dma_fence *fence;
dc2f7e67a28a5c Chris Wilson 2020-04-09 323 int err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 324 int i;
dc2f7e67a28a5c Chris Wilson 2020-04-09 325
dc2f7e67a28a5c Chris Wilson 2020-04-09 326 err = fence_chains_init(&fc, 64, seqno_inc2);
6055c9e333cfbb Jason Gunthorpe 2026-03-01 327 KUNIT_ASSERT_EQ_MSG(test, err, 0, "Failed to init fence chains");
dc2f7e67a28a5c Chris Wilson 2020-04-09 328
dc2f7e67a28a5c Chris Wilson 2020-04-09 329 for (i = 0; i < fc.chain_length; i++) {
dc2f7e67a28a5c Chris Wilson 2020-04-09 330 fence = dma_fence_get(fc.tail);
dc2f7e67a28a5c Chris Wilson 2020-04-09 331 err = dma_fence_chain_find_seqno(&fence, 2 * i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 @332 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 333 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 334 KUNIT_FAIL(test, "Reported %d for find_seqno(%d:%d)!",
dc2f7e67a28a5c Chris Wilson 2020-04-09 335 err, fc.chain_length + 1, 2 * i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 336 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 337 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 338 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 @339 KUNIT_FAIL(test, "Incorrect fence.seqno:%lld reported by find_seqno(%d:%d)",
dc2f7e67a28a5c Chris Wilson 2020-04-09 340 fence->seqno,
dc2f7e67a28a5c Chris Wilson 2020-04-09 341 fc.chain_length + 1,
dc2f7e67a28a5c Chris Wilson 2020-04-09 342 2 * i + 1);
dc2f7e67a28a5c Chris Wilson 2020-04-09 343 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 344 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 345
dc2f7e67a28a5c Chris Wilson 2020-04-09 346 dma_fence_get(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 347 err = dma_fence_chain_find_seqno(&fence, 2 * i + 2);
dc2f7e67a28a5c Chris Wilson 2020-04-09 348 dma_fence_put(fence);
dc2f7e67a28a5c Chris Wilson 2020-04-09 349 if (err) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 350 KUNIT_FAIL(test, "Error reported for finding self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 351 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 352 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 353 if (fence != fc.chains[i]) {
6055c9e333cfbb Jason Gunthorpe 2026-03-01 354 KUNIT_FAIL(test, "Incorrect fence reported by find self");
dc2f7e67a28a5c Chris Wilson 2020-04-09 355 goto err;
dc2f7e67a28a5c Chris Wilson 2020-04-09 356 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 357 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 358
dc2f7e67a28a5c Chris Wilson 2020-04-09 359 err:
dc2f7e67a28a5c Chris Wilson 2020-04-09 360 fence_chains_fini(&fc);
dc2f7e67a28a5c Chris Wilson 2020-04-09 361 }
dc2f7e67a28a5c Chris Wilson 2020-04-09 362
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-09-08 6:07 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-08 6:06 kernel test robot [this message]
2026-09-10 14:15 ` drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195) Dan Carpenter
2026-09-11 7:49 ` Christian König
2026-09-11 12:22 ` Dan Carpenter
2026-09-11 16:26 ` Christian König
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202609081301.6ARYAElY-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.