Re: drivers/dma-buf/st-dma-fence-chain.c:207 test_find_seqno() warn: passing freed memory 'fence' (line 195)

[Christian König]

On 9/11/26 14:22, Dan Carpenter wrote:
> On Fri, Sep 11, 2026 at 09:49:54AM +0200, Christian König wrote:
>> Hi Dan,
>>
>> I just double check and this one and the other "warn: passing freed memory 'fence'" look like a false positive to me.
>>
>> Any idea why smatch things that the memory is already freed in the test case?
> 
> dma_fence_put() can free the fence if we drop the last reference.
> Or imagine that we aren't holding the last reference and a different
> thread is holding it and they could call dma_fence_put() which is
> also a use after free.
> 
> Incrementing then decrementing then incrementing the reference
> count doesn't make any sense.  We are relying on something else
> to hold the reference.  If we can rely on that, then we don't
> need to increment and decrement the reference count for certain
> basically random places.

Ok, well then that indeed seems to be a false positive from smatch.

The pattern is this:

get(fence);
make_fence_point_to_something_different(&fence);
put(fence);

The make_fence_point_to_something_different() function consumes the original fence reference and returns a new one. So the get/put dance is completely correct. (Well it indeed doesn't make much sense, normally you would do something with the returned reference before calling put. But that here is just to test the make_fence_point_to_something_different() function).

Regards,
Christian.

> 
> regards,
> dan carpenter
>