CVE-2026-63929: iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()

In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: Fix DMA fence leak in iiobufferenqueuedmabuf()

iiobufferenqueuedmabuf() allocates a struct iiodmafence (104 bytes, kmalloc-128) via kmallocobj()+dmafenceinit(), which sets the initial kref to 1. It then calls dmaresvaddfence() which takes a second reference (kref=2), and stores a raw pointer in block->fence.

On the success path the function returns without calling dmafenceput() to release the initial reference, so every buffer enqueue permanently leaks one kmalloc-128 allocation.

The iiobuffercleanup() work item only releases the temporary reference taken during completion signalling by iiobuffersignaldmabufdone(); the initial reference from dmafenceinit() is never released.

With four iiorwdev instances at 240kHz and 512 samples per buffer, this produces ~1875 kmalloc-128 allocations per second matching the observed slab growth exactly. A test with ftrace confirmed that the dmafencedestroy event was never triggered.

Fix by calling dmafenceput() after dmaresvaddfence(), transferring ownership of the fence to the DMA reservation object. The DMA fence then gets properly discarded after being signalled.