github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-25 15:41:52 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/v3d: Fix use-after-free of CPU job query arrays on error path

Browse Source 
The CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and
performance query arrays after v3d_job_cleanup(), which drops the job's
last reference and frees cpu_job. Reading cpu_job at that point is a
use-after-free. Also, on the early v3d_job_init() failure path, it is a
NULL dereference, since v3d_job_deallocate() zeroes the local pointer.

In the success path, the arrays are released from the scheduler's
.free_job callback, but on the error path, they are freed manually, as
the job was never pushed to the scheduler. While the success path deals
with this correctly, the fail path doesn't.

On top of that, the manual kvfree() calls only free the array storage;
they don't drm_syncobj_put() the per-query syncobjs that
v3d_timestamp_query_info_free() and v3d_performance_query_info_free()
release on the success path. So the same fail path that triggers the
use-after-free also leaks one syncobj reference per query.

Unify the CPU job teardown into the CPU job's kref destructor, mirroring
v3d_render_job_free(). The scheduler's .free_job slot reverts to the
generic v3d_sched_job_free() and the fail label drops the manual
kvfree() calls, leaving a single teardown path that is reached from both
the scheduler and the ioctl error path. That removes the use-after-free,
the NULL dereference, and the syncobj leak by construction.

Cc: stable@vger.kernel.org
Fixes: 9ba0ff3e08 ("drm/v3d: Create a CPU job extension for the timestamp query job")
Assisted-by: Claude:claude-opus-4.7
Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
Link: https://patch.msgid.link/20260515-v3d-cpu-job-leaks-v1-1-7f147cbbf935@igalia.com
Signed-off-by: Maíra Canal <mcanal@igalia.com>
This commit is contained in:
Maíra Canal 2026-05-15 12:07:14 -03:00
parent 379e8f1ca5
commit b0fe80c0b9
No known key found for this signature in database
GPG Key ID: 3FF30E8A7688FAAA
2 changed files with 17 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/gpu/drm/v3d/v3d_sched.c
View File

@ -125,20 +125,6 @@ v3d_performance_query_info_free(struct v3d_performance_query_info *query_info,
}
}
static void
v3d_cpu_job_free(struct drm_sched_job *sched_job)
{
struct v3d_cpu_job *job = to_cpu_job(sched_job);
v3d_timestamp_query_info_free(&job->timestamp_query,
job->timestamp_query.count);
v3d_performance_query_info_free(&job->performance_query,
job->performance_query.count);
v3d_job_cleanup(&job->base);
}
static void
v3d_switch_perfmon(struct v3d_dev *v3d, struct v3d_job *job)
{
@ -830,7 +816,7 @@ static const struct drm_sched_backend_ops v3d_cache_clean_sched_ops = {
static const struct drm_sched_backend_ops v3d_cpu_sched_ops = {
.run_job = v3d_cpu_job_run,
.free_job = v3d_cpu_job_free
.free_job = v3d_sched_job_free
};
static int

19
drivers/gpu/drm/v3d/v3d_submit.c
View File

@ -123,6 +123,21 @@ v3d_render_job_free(struct kref *ref)
v3d_job_free(ref);
}
static void
v3d_cpu_job_free(struct kref *ref)
{
struct v3d_cpu_job *job = container_of(ref, struct v3d_cpu_job,
base.refcount);
v3d_timestamp_query_info_free(&job->timestamp_query,
job->timestamp_query.count);
v3d_performance_query_info_free(&job->performance_query,
job->performance_query.count);
v3d_job_free(ref);
}
void v3d_job_cleanup(struct v3d_job *job)
{
if (!job)
@ -1302,7 +1317,7 @@ v3d_submit_cpu_ioctl(struct drm_device *dev, void *data,
trace_v3d_submit_cpu_ioctl(&v3d->drm, cpu_job->job_type);
ret = v3d_job_init(v3d, file_priv, &cpu_job->base,
v3d_job_free, 0, &se, V3D_CPU);
v3d_cpu_job_free, 0, &se, V3D_CPU);
if (ret) {
v3d_job_deallocate((void *)&cpu_job);
goto fail;
@ -1385,8 +1400,6 @@ v3d_submit_cpu_ioctl(struct drm_device *dev, void *data,
v3d_job_cleanup((void *)csd_job);
v3d_job_cleanup(clean_job);
v3d_put_multisync_post_deps(&se);
kvfree(cpu_job->timestamp_query.queries);
kvfree(cpu_job->performance_query.queries);
return ret;
}