xe_range_fence_insert() acquires a reference on fence via dma_fence_get() and stores it in rfence->fence. It then calls dma_fence_add_callback() and handles two cases: when the callback is successfully registered (err == 0) the fence is transferred to the tree for later cleanup; when the fence is already signaled (err == -ENOENT) it manually drops the extra reference with dma_fence_put(fence). However, dma_fence_add_callback() can fail with other errors (e.g. -EINVAL) and in that case the code falls through to the free: label without releasing the acquired reference, leaking it. Fix the leak by adding an else branch that calls dma_fence_put() before jumping to free: for any error other than -ENOENT.
Unified · Split
| @@ -77,6 +77,8 @@ int xe_range_fence_insert(struct xe_range_fence_tree *tree, · 76 unmodified lines | ||
| 77 | 77 | } else if (err == 0) { |
| 78 | 78 | xe_range_fence_tree_insert(rfence, &tree->root); |
| 79 | 79 | return 0; |
| 80 | + } else { | |
| 81 | + dma_fence_put(fence); | |
| 80 | 82 | } |
| 81 | 83 | |
| 82 | 84 | free: |