In the Linux kernel, the following vulnerability has been resolved:
dma-buf/sync_file: Don't leak fences on merge failure
Each addfence() call does a dmafenceget() on the relevant fence. In the error path, we weren't calling dmafenceput() so all those fences got leaked. Also, in the kreallocarray failure case, we weren't freeing the fences array. Instead, ensure that i and fences are always zero-initialized and dmafenceput() all the fences and kfree(fences) on every error path.