In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: Fix WARNON in nouveaufencecontextkill()
Nouveau is mostly designed in a way that it's expected that fences only ever get signaled through nouveaufencesignal(). However, in at least one other place, nouveaufencedone(), can signal fences, too. If that happens (race) a signaled fence remains in the pending list for a while, until it gets removed by nouveaufenceupdate().
Should nouveaufencecontext_kill() run in the meantime, this would be a bug because the function would attempt to set an error code on an already signaled fence.
Have nouveaufencecontext_kill() check for a fence being signaled.