Re: [PATCH 09/19] usb: gadget: f_fs: let the request keep its fence

[sashiko-bot@kernel.org]

> From: Josef Bacik <josef@toxicpanda.com>
> 
> ffs_dmabuf_transfer() stores a plain pointer to the fence in the context
> of the USB request, and since the fix for the fence leak it drops the
> initial reference right after dma_resv_add_fence(). The only reference
> left is the one of the reservation object.
> 
> That one does not last until the fence is signalled. dma_resv_add_fence()
> replaces and puts a fence as soon as a later fence of the same context
> and the same usage is added. All the fences of an attachment share a
> context, and a transfer on an IN endpoint only waits for the writers,
> not for the read fence of the transfer before it. So the second
> FUNCTIONFS_DMABUF_TRANSFER of a buffer which is still queued frees the
> fence of the first. When the first request completes,
> ffs_dmabuf_signal_done() signals a fence in freed memory and queues the
> work item in it.
> 
> The leak came from the reference which ffs_dmabuf_signal_done() takes
> and ffs_dmabuf_cleanup() drops: with it nobody dropped the initial one.
> Do not take it, and leave the initial reference to the request until the
> cleanup.
> 
> Fixes: baa6b6068a3f ("usb: gadget: f_fs: Fix DMA fence leak")
> Cc: stable <stable@kernel.org>
> Cc: Neill Kapron <nkapron@google.com>
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261027-llm-usb-v1-0-b9751ddb9c7c@linuxfoundation.org?part=9