On Fri, 15 May 2026 12:07:13 -0300, Maíra Canal wrote: > This series addresses two independent teardown bugs in V3D's CPU job > submission path: > > - PATCH 1: A use-after-free on the ioctl's fail label, where the timestamp > and performance query arrays are freed through cpu_job after > v3d_job_cleanup() has already released the job. It consolidates the CPU > job teardown into the job's kref destructor so a single code path covers > both the scheduler .free_job and ioctl error paths. > > [...]
Added the `Cc: [email protected]` tag to the patches and applied to drm-misc-fixes. [1/2] drm/v3d: Fix use-after-free of CPU job query arrays on error path commit: b0fe80c0b9250b35e2211bf3117e7aca814a21b0 [2/2] drm/v3d: Release indirect CSD GEM reference on CPU job free commit: 6eb6e5acafa46854d4363e6c34981289995f3ace Best regards, - Maíra
