Re: drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195)

[Dan Carpenter]

On Fri, Sep 11, 2026 at 09:49:54AM +0200, Christian König wrote:
> Hi Dan,
> 
> I just double check and this one and the other "warn: passing freed memory 'fence'" look like a false positive to me.
> 
> Any idea why smatch things that the memory is already freed in the test case?

dma_fence_put() can free the fence if we drop the last reference.
Or imagine that we aren't holding the last reference and a different
thread is holding it and they could call dma_fence_put() which is
also a use after free.

Incrementing then decrementing then incrementing the reference
count doesn't make any sense.  We are relying on something else
to hold the reference.  If we can rely on that, then we don't
need to increment and decrement the reference count for certain
basically random places.

regards,
dan carpenter