[PATCH] fix: dma-buf: fence_chains_init: error unwind path leaks enable_sw_signaling reference

[WenTao Liang]

dma_fence_enable_sw_signaling acquires an extra reference on each chain
  fence. The error unwind loop calls dma_fence_put only once per
  chain/fence without first signaling the fence to trigger the callback
  that releases the signaling reference. This prevents the chain fence kref
  from reaching 0, permanently leaking the chain and its contained fence.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: dc2f7e67a28a ("dma-buf: Exercise dma-fence-chain under selftests")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
 drivers/dma-buf/st-dma-fence-chain.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/dma-buf/st-dma-fence-chain.c b/drivers/dma-buf/st-dma-fence-chain.c
index 821023dd34df..7dc18e294387 100644
--- a/drivers/dma-buf/st-dma-fence-chain.c
+++ b/drivers/dma-buf/st-dma-fence-chain.c
@@ -152,7 +152,10 @@ static int fence_chains_init(struct fence_chains *fc, unsigned int count,
 
 unwind:
 	for (i = 0; i < count; i++) {
-		dma_fence_put(fc->fences[i]);
+		if (fc->fences[i]) {
+			dma_fence_signal(fc->fences[i]);
+			dma_fence_put(fc->fences[i]);
+		}
 		dma_fence_put(fc->chains[i]);
 	}
 	kvfree(fc->fences);
-- 
2.39.5 (Apple Git-154)