Two bugs exist in ethosu_ioctl_submit_job(): 1. Use-after-free via NULL pointer dereference: When done_fence allocation fails, the error path jumps to out_cleanup_job which calls drm_sched_job_cleanup() on an uninitialized struct, dereferencing the NULL s_fence pointer.
2. Memory leak of done_fence: The done_fence struct is allocated separately with kzalloc() but is never freed on any error path that occurs after successful allocation (including drm_sched_job_init failure, BO lookup failures, etc.). It cannot be freed via dma_fence_put() because dma_fence_init() is not called until ethosu_job_run(). Fix by: - Changing the done_fence allocation failure goto target from out_cleanup_job to out_put_job, which skips the uninitialized drm_sched_job_cleanup() call. - Adding kfree(job->done_fence) in ethosu_job_err_cleanup() to ensure the separately allocated fence struct is released on all error paths. Cc: [email protected] Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Signed-off-by: Wentao Liang <[email protected]> --- drivers/accel/ethosu/ethosu_job.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethosu_job.c index ec85f4156744..9a8164a54454 100644 --- a/drivers/accel/ethosu/ethosu_job.c +++ b/drivers/accel/ethosu/ethosu_job.c @@ -150,6 +150,7 @@ static void ethosu_job_err_cleanup(struct ethosu_job *job) for (i = 0; i < job->region_cnt; i++) drm_gem_object_put(job->region_bo[i]); + kfree(job->done_fence); drm_gem_object_put(job->cmd_bo); kfree(job); @@ -393,7 +394,7 @@ static int ethosu_ioctl_submit_job(struct drm_device *dev, struct drm_file *file ejob->done_fence = kzalloc_obj(*ejob->done_fence); if (!ejob->done_fence) { ret = -ENOMEM; - goto out_cleanup_job; + goto out_put_job; } ret = drm_sched_job_init(&ejob->base, -- 2.39.5 (Apple Git-154)
