From nobody Mon Jun 8 23:56:24 2026 Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 942711DF26E for ; Mon, 25 May 2026 14:04:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779717895; cv=none; b=gBWs6fnVkq+jgd/swkHgULTodggwMmQGn0UAHg6Am/sLlA9/nmr0qLq2vW2CAZpZNvE84HO9G8VWDoV4MMf6/S4u29TremSXrqEwzPTgnjNGUIPxtrU9LsDEtH+p1i2MxD0lXWuFm1GKenWWAeHjDI8PE9eqRBFIC1DCxsLV6Bo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779717895; c=relaxed/simple; bh=RaaETJqcZ1UOxuxsL2W+DJJdBTZ0HUyFuBLRacBh6ks=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=ZUOJXCGEz7UmTfBhtLc4fCH0FW8lI4mITmBvHg5Ni4h7T5x+J07gnWEF84rMx6XGTuNIJl00c7V0m976mhJS426aZ5hdP+21A5HfF57adUQepNHIofjL031DcZrygb3V6f980s0D3zc5S0V2wuxfZ3DTiL27qLAeCyWNfY+5YMw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=q8APrOHC; arc=none smtp.client-ip=209.85.216.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="q8APrOHC" Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-3695bf7d082so8675690a91.0 for ; Mon, 25 May 2026 07:04:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779717894; x=1780322694; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=WU7p0G56s5zfUOdQ7oDtFqcXISuvDEUQ45whz+2fmhs=; b=q8APrOHCJodUQJd8NF90J2b5b3tpggVcLxLyPRHZFM5fjoM7SsXoETx4YK1C4ESNFg Xra+39itugTvItkXV8/AtF7PbGd+v98n/mHK1Iq79TO1cOo03gEPIKfgexzBD7SG9uuS MvVvfCeqk4rTd0KD0Y6Nf07vgks03JSrVqUPSYtGjObpXwsQjdyBNKRE2bY5NlxdTTHr coRsFforGwWR35QSdYxV72Mf5SOzapbuLnoM2tAoycmsmUqpzJgckNLVJz4qLdktTLCC hzpXXR1xSEAqu8Cyc1gn+c2jMztgQ0wVr5PpPUbZs2BNRUYV7HgX2XlnRtqxgX+/FWXf hBYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779717894; x=1780322694; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=WU7p0G56s5zfUOdQ7oDtFqcXISuvDEUQ45whz+2fmhs=; b=fdPTQhuEcqwUGJFMOLqNAmfCGH9UjXsHTqfE6oBKODsgSE5v2RNMaQU2HHW7XTioqx OJzRJF6Cu0On2TvdxH88jdBLGo3IrxcwEip5Nb65wPZT68Kk7yQHhQjREIh7tEulzQ/N ajSa+JwUH/x9j0Im+BMuz5tzeeMCo7rCzBVdg506Z8Ij3o3qh9gUf75UPTEd8x6T0RNd xsfOU1s1jDIQ8UuJYTfJ/ykKK90a1zyY0RlOcsUIY22l22jCTmewljcL9D57usD2QW4r lEwH3JqF5bbygz8drjyym1jBVOwkc1kg5ad9FSw2lIbSTUt+4XcLmrTcSYcO7Wh3m2dX +oxA== X-Forwarded-Encrypted: i=1; AFNElJ9yjjQwsLxwD+Hse1o/48VtPBxSQOx9vh3PJwjoByB9R+tUDVpKH9iRklctwVRF3/C0adlQv4knM/nYY50=@vger.kernel.org X-Gm-Message-State: AOJu0YxP7qaF173VcF5LJ4ykbwRGYiSi7AjfFYBFXupJ4wRAa3sXcNWT iWx7EJUb1UMKeHRqdXLGTXNP48op6404TP7/mF90Hz/oxPtBCx1+iBqA X-Gm-Gg: Acq92OGvP9VCLqCOpffbSHXGLRMwIB+HeSnkri0M2zs/J9J/I48Auldu6CGV6W9wR5i +ot7Hawcs6ULCERwpVDciCMHhxjhihyA940rurXfuPttp9y9k8fz27wNlhJpGJmSkBXwWH5W3BN fYAhbZp8cl4AuqSYs7riC+N9KwkhjtNrmNwtDyEwV2iO+L6E/aS1czKEyTKcg3hTjyLeTyk8Kha 8k1pLmEZZ1EJG4ccetOBk3YJh+DHcFizWq04CP7G2V+7HcDJXjvk/Kx7irHnFh70T+Et1OKajso 8nNsIi1U+WnXjp7xUpuvq/xk72Lkrx5poCGC3Z7VmvUt3shy4E13P+xpHTFdItLPk9MuRggFJqJ ViuL2l9L+DjtXeAEp6+hHPNTiJm3LuLWJO6qmKk63kYTS1LMoRMkLvV6IcQk/wDXXIPzHCXu6yY TT6buzdXGlMtzXfua1H9k99wHKVJNRzfdk8CqDAIhGqvE= X-Received: by 2002:a17:90a:c88d:b0:366:10f1:3d86 with SMTP id 98e67ed59e1d1-36a67616988mr15429149a91.22.1779717893603; Mon, 25 May 2026 07:04:53 -0700 (PDT) Received: from name2965-Precision-7820-Tower.. ([14.48.8.61]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36a726348e2sm9635503a91.2.2026.05.25.07.04.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 25 May 2026 07:04:53 -0700 (PDT) From: Jeongjun Park To: Melissa Wen , =?UTF-8?q?Ma=C3=ADra=20Canal?= Cc: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Iago Toral Quiroga , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, stable@kernel.org, Jeongjun Park Subject: [PATCH] drm/v3d: fix to avoid cleaning up uninitialized CPU jobs Date: Mon, 25 May 2026 23:04:22 +0900 Message-Id: <20260525140422.1545327-1-aha310510@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The CPU submit ioctl checks cpu_job->job_type before the CPU job has been initialized with v3d_job_init(). When no CPU job extension is supplied, the check fails and the ioctl goes to the common error path. That path calls v3d_job_cleanup(), which expects a fully initialized v3d_job. However at this point the CPU job has only been allocated, so the embedded DRM scheduler job state has not been initialized yet. Initialize the CPU job after parsing extensions, but before validating the CPU job type and BO count. Keep pre-initialization failures on a separate path that only deallocates the job and releases multisync post-dependencies. Also use the CPU-job release callback so initialized CPU jobs are released through the normal cleanup path. Cc: stable@kernel.org Fixes: aafc1a2bea67 ("drm/v3d: Add a CPU job submission") Signed-off-by: Jeongjun Park --- drivers/gpu/drm/v3d/v3d_submit.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/drivers/gpu/drm/v3d/v3d_submit.c b/drivers/gpu/drm/v3d/v3d_sub= mit.c index 3ddd53b6f437..f5a1b388eaa3 100644 --- a/drivers/gpu/drm/v3d/v3d_submit.c +++ b/drivers/gpu/drm/v3d/v3d_submit.c @@ -1300,10 +1300,18 @@ v3d_submit_cpu_ioctl(struct drm_device *dev, void *= data, ret =3D v3d_get_extensions(file_priv, args->extensions, &se, cpu_job); if (ret) { drm_dbg(dev, "Failed to get extensions.\n"); - goto fail; + v3d_job_deallocate((void *)&cpu_job); + goto fail_init; } } =20 + ret =3D v3d_job_init(v3d, file_priv, &cpu_job->base, + v3d_cpu_job_free, 0, &se, V3D_CPU); + if (ret) { + v3d_job_deallocate((void *)&cpu_job); + goto fail_init; + } + /* Every CPU job must have a CPU job user extension */ if (!cpu_job->job_type) { drm_dbg(dev, "CPU job must have a CPU job user extension.\n"); @@ -1319,13 +1327,6 @@ v3d_submit_cpu_ioctl(struct drm_device *dev, void *d= ata, =20 trace_v3d_submit_cpu_ioctl(&v3d->drm, cpu_job->job_type); =20 - ret =3D v3d_job_init(v3d, file_priv, &cpu_job->base, - v3d_cpu_job_free, 0, &se, V3D_CPU); - if (ret) { - v3d_job_deallocate((void *)&cpu_job); - goto fail; - } - clean_job =3D cpu_job->indirect_csd.clean_job; csd_job =3D cpu_job->indirect_csd.job; =20 @@ -1402,6 +1403,8 @@ v3d_submit_cpu_ioctl(struct drm_device *dev, void *da= ta, v3d_job_cleanup((void *)cpu_job); v3d_job_cleanup((void *)csd_job); v3d_job_cleanup(clean_job); + +fail_init: v3d_put_multisync_post_deps(&se); =20 return ret; --