dma-fence: Make dma_fence_dedup_array() robust against 0-count input
authorBaineng Shou <shoubaineng@gmail.com>
Mon, 29 Jun 2026 03:13:46 +0000 (11:13 +0800)
committerChristian König <christian.koenig@amd.com>
Mon, 29 Jun 2026 11:35:46 +0000 (13:35 +0200)
commit77a9298741f8f9e8b963c977f5582ab21c6d3427
tree858a433571726ab8e7c7c81ea3907d914c167c18
parent035219a760edb35ae9a9e96beba7f122e26a997b
dma-fence: Make dma_fence_dedup_array() robust against 0-count input

dma_fence_dedup_array() returns 1 when called with num_fences == 0:
the for-loop body never executes, j stays at 0, and the final
`return ++j` yields 1. This contradicts both the kernel-doc ("Return:
Number of unique fences remaining in the array") and the natural
expectation that 0 input gives 0 output.

The caller __dma_fence_unwrap_merge() bails out via the
`if (count == 0 || count == 1)` fast path and so is save.

But amdgpu_userq_wait_*() could reach the dedup call with a zero local
count and dereference an uninitialized fence slot in the array.

Make the contract match the documentation by returning 0 early. This
also skips an unnecessary sort() call on an empty array.

Cc: stable@vger.kernel.org
Signed-off-by: Baineng Shou <shoubaineng@gmail.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Fixes: 575ec9b0c2f1 ("dma-fence: Add helper to sort and deduplicate dma_fence arrays")
Signed-off-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/20260629031346.3875683-1-shoubaineng@gmail.com
drivers/dma-buf/dma-fence-unwrap.c