Hi Karl, Thank you for your contribution! Unfortunately, this issue is already addressed in drm-misc-next.
Best regards, - Maíra On 15/08/26 11:59, Karl Mehltretter wrote:
v3d_submit_cpu_ioctl() allocates cpu_job before initializing its embedded drm_sched_job. If extension parsing fails, no CPU job extension is supplied, or the BO count is invalid, it jumps to fail before v3d_job_init(). v3d_job_cleanup() then calls drm_sched_job_cleanup() with a NULL s_fence, causing a NULL pointer dereference. An empty DRM_IOCTL_V3D_SUBMIT_CPU (flags == 0) is sufficient to trigger it. Deallocate the job and clear the pointer on these paths, matching the existing handling when v3d_job_init() fails. v3d_job_deallocate() frees only the top-level job. If extension parsing already allocated query or indirect-CSD state, that state still leaks on these error paths, turning the former oops into a repeatable leak. Fixing this safely is more involved and beyond the scope of this fix. This patch therefore addresses only the crash. Fixes: aafc1a2bea674 ("drm/v3d: Add a CPU job submission") Cc: [email protected] Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Karl Mehltretter <[email protected]> --- Tested on a Raspberry Pi 400: the unpatched kernel oopses on flags=0; with this patch the ioctl returns -EINVAL without an oops. drivers/gpu/drm/v3d/v3d_submit.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/v3d/v3d_submit.c b/drivers/gpu/drm/v3d/v3d_submit.c index 7682b24f13ec5..304950ba42a38 100644 --- a/drivers/gpu/drm/v3d/v3d_submit.c +++ b/drivers/gpu/drm/v3d/v3d_submit.c @@ -1313,6 +1313,7 @@ v3d_submit_cpu_ioctl(struct drm_device *dev, void *data, ret = v3d_get_extensions(file_priv, args->extensions, &se, cpu_job); if (ret) { drm_dbg(dev, "Failed to get extensions.\n"); + v3d_job_deallocate((void *)&cpu_job); goto fail; } } @@ -1321,12 +1322,14 @@ v3d_submit_cpu_ioctl(struct drm_device *dev, void *data, if (!cpu_job->job_type) { drm_dbg(dev, "CPU job must have a CPU job user extension.\n"); ret = -EINVAL; + v3d_job_deallocate((void *)&cpu_job); goto fail; }if (args->bo_handle_count != cpu_job_bo_handle_count[cpu_job->job_type]) {drm_dbg(dev, "This CPU job was not submitted with the proper number of BOs.\n"); ret = -EINVAL; + v3d_job_deallocate((void *)&cpu_job); goto fail; }
