v3d_submit_cpu_ioctl() allocates cpu_job before initializing its embedded
drm_sched_job. If extension parsing fails, no CPU job extension is
supplied, or the BO count is invalid, it jumps to fail before
v3d_job_init().
v3d_job_cleanup() then calls drm_sched_job_cleanup() with a NULL s_fence,
causing a NULL pointer dereference.
An empty DRM_IOCTL_V3D_SUBMIT_CPU (flags == 0) is sufficient to trigger it.
Deallocate the job and clear the pointer on these paths, matching the
existing handling when v3d_job_init() fails.
v3d_job_deallocate() frees only the top-level job. If extension parsing
already allocated query or indirect-CSD state, that state still leaks on
these error paths, turning the former oops into a repeatable leak.
Fixing this safely is more involved and beyond the scope of this fix. This
patch therefore addresses only the crash.
Fixes: aafc1a2bea674 ("drm/v3d: Add a CPU job submission")
Cc: [email protected]
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <[email protected]>
---
Tested on a Raspberry Pi 400: the unpatched kernel oopses on flags=0; with
this patch the ioctl returns -EINVAL without an oops.
drivers/gpu/drm/v3d/v3d_submit.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/v3d/v3d_submit.c b/drivers/gpu/drm/v3d/v3d_submit.c
index 7682b24f13ec5..304950ba42a38 100644
--- a/drivers/gpu/drm/v3d/v3d_submit.c
+++ b/drivers/gpu/drm/v3d/v3d_submit.c
@@ -1313,6 +1313,7 @@ v3d_submit_cpu_ioctl(struct drm_device *dev, void *data,
ret = v3d_get_extensions(file_priv, args->extensions, &se,
cpu_job);
if (ret) {
drm_dbg(dev, "Failed to get extensions.\n");
+ v3d_job_deallocate((void *)&cpu_job);
goto fail;
}
}
@@ -1321,12 +1322,14 @@ v3d_submit_cpu_ioctl(struct drm_device *dev, void *data,
if (!cpu_job->job_type) {
drm_dbg(dev, "CPU job must have a CPU job user extension.\n");
ret = -EINVAL;
+ v3d_job_deallocate((void *)&cpu_job);
goto fail;
}
if (args->bo_handle_count !=
cpu_job_bo_handle_count[cpu_job->job_type]) {
drm_dbg(dev, "This CPU job was not submitted with the proper
number of BOs.\n");
ret = -EINVAL;
+ v3d_job_deallocate((void *)&cpu_job);
goto fail;
}
--
2.53.0
