From nobody Sat Jul 25 21:20:57 2026 Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ECB1D329E79 for ; Mon, 13 Jul 2026 16:06:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783958815; cv=none; b=ptTBi7vQ5wQZVcduWVdsEhl9b0HwCcO0LMp6dvaExkquxTi3iP7RaW16/W80mpr1JZTT/M66qrjmzmrO2gjefrorv5Bcsx6S7MSdVbiwPQVJjKko11ijRlPRxRfs6uty3Nv7H5DT6Ifvsco953hndvbfSHOI95w5bfZUGJX9ZVg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783958815; c=relaxed/simple; bh=UegYq5bsuhO94gvhZ52G7sFzsfmxbjuMOMoMfG/h8mg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=UslA5Wi3B14LSNrA8heAYJkRBzwMmvFEOvH5doRmvf8VdzlYfJhCDkcOUjrfpRJx5jQ9QlSeyjt2wB8qqSG8Gai5naRVU9fQfaRpl8WnZcgVAyCxFR+hEVRiabvroUVpqjMZ2j51ZA62/Nsd/XkyxjeFYlcwmOEYGUsb6tDjnvM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=aWP3C8qz; arc=none smtp.client-ip=209.85.214.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="aWP3C8qz" Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2ceb096e675so21382825ad.0 for ; Mon, 13 Jul 2026 09:06:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783958809; x=1784563609; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=ryGtyXUkJGyx4y6Y9GxT62jrJOuVmMDJpP45K17ylC4=; b=aWP3C8qzrS2uEL85ngTBdxG+qDayRXTus3orhZamxso79rkl0h5tVj6npQvp/O/oBK 9JsiU/1XHX5hPTY+nGQcHO3H0L+gstd4dHKYewZT5G0cyvmDSCvMjZEOIAhHEOOrwO/Y R6fyXpaVh3N0htvP74gnQRYE6KpkTvFStzxFT7y7A9MgNF5dGAACa5MXogBBOZbaVvgi 0uQgKLJTEqd7sJOcEdH5bKa8bwiMyy7S7ntJz38jViM4FfqW4RCnayefWGkYET4mZIyS AfJyuUdAlhj8G9TvjkFhpclxW9SGeWmV6wNC0Sc28lrr+2zRTZJ4RYg5R14oL56+AEY3 RuWA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783958809; x=1784563609; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=ryGtyXUkJGyx4y6Y9GxT62jrJOuVmMDJpP45K17ylC4=; b=C/GmR2898pKPiUuCezqOBWX4xg8Pglwrmx4VoKLFfA7NmDV6gVPe2McWDxHBJa4T44 eaxC7P+ANF6617zD5G/Ch5wC5ZBXLn4zqAnnmvU7FR27KDEPFUNrfH2z/WbOyqhYanzm xN0d8AFSHheB3PsxEE037cXWV8gw9GX13psUqX9ZzaY2Vp+Hcu3yePul10pLLfnTZbwp lWyAo1zq5k/TkzD9X2xdIN1IBdLVFcFK2EdZI/Kxkrvhbfa9HD8FiUHXhj2Q2MR+/6G0 B8snwYGythvv4VINrpJE+SHY/z300lT2XokIQokU2hnH28FfxQlWYrOIyR6Qkth34pJk qFZw== X-Forwarded-Encrypted: i=1; AHgh+RoXe3R33Bg9eXEDNv03kCb7SXFasx/zjv4yQAp2jR9dwH67leQKq66jYj56USbghln/ZOWbUTnZxLcfzVU=@vger.kernel.org X-Gm-Message-State: AOJu0YxAww7Yl1xu30ZZvNn4bOcKIxOSQvfzWr60ytivuYKmg/NcLVIt ViLJckyFwcPg064xbDbrzt1lIpDJX7SMHt8QexYjova1Ij9610agagCO X-Gm-Gg: AfdE7clKiiZgL6VSHzKQh4uGxK+UkSEiIWOZhPzgLt2r8pBNkG79lRNsspmxjwLq1wB 8ueS4cR2N6bJSZgOj0tXUmchCaa4YJEllrJtBB2zU4f3qdG4IXCVVyqNd/VYuYNOnMMla1EdAsJ t1DJdb5K5sp/6mOQaCR+akE+GxVf3awqhZAnQP5zoSSWG6eTm5NdrL3sljqz/8MKBmnC64riMiP Zcqoni6U5gRHWRqdYpVAmdZa55APsdS3NuGIoX9sRUmw4DajH4tc+NM7j8F8jW/0HF+VhIW3DaS XHv2HwHexfmMKzNmzSWp5vjK/Y1aaNAsmAz/Pv0fdhiEzL+cmITClXoBGMy1GsAHIAyqtmBgXZc eZ1aWEC2xWZ86kH0ZxszhBNwkvmIc3rG82rsPaPf/uZxntbWyYyYvsBaNcwKSypGIFDIZ+KIenB zOmyM= X-Received: by 2002:a17:90b:2781:b0:387:df8f:1401 with SMTP id 98e67ed59e1d1-38dc77a7b96mr9946987a91.34.1783958808546; Mon, 13 Jul 2026 09:06:48 -0700 (PDT) Received: from lgs.. ([101.36.109.157]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38e172b6d08sm140025a91.2.2026.07.13.09.06.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 09:06:48 -0700 (PDT) From: Guangshuo Li To: Melissa Wen , =?UTF-8?q?Ma=C3=ADra=20Canal?= , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Iago Toral Quiroga , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li Subject: [PATCH v2] drm/v3d: release CPU job resources on pre-init failures Date: Tue, 14 Jul 2026 00:05:31 +0800 Message-ID: <20260713160630.1362131-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The changes referenced by the Fixes tags moved CPU job resource cleanup to v3d_cpu_job_free(), the CPU job kref destructor. However, CPU job extensions are parsed before v3d_job_init() has successfully installed that destructor. Timestamp and performance query arrays, their syncobj references, and the indirect CSD GEM reference can therefore be acquired before the CPU job is managed by the kref cleanup path. If a later pre-init validation fails, or if v3d_job_init() itself fails, the CPU job can be cleaned up or deallocated without running v3d_cpu_job_free(). Those extension resources are then leaked. Move the CPU-job-owned resource release into a helper and call it both from the normal CPU job destructor and from the pre-init error paths. Fixes: b0fe80c0b925 ("drm/v3d: Fix use-after-free of CPU job query arrays o= n error path") Fixes: 6eb6e5acafa4 ("drm/v3d: Release indirect CSD GEM reference on CPU jo= b free") Signed-off-by: Guangshuo Li --- v2: - Rebase onto drm-misc-fixes. - Fold the indirect CSD GEM pre-init failure fix into this patch. - Drop unnecessary pointer and count resets after releasing resources, as suggested by Ma=C3=ADra Canal. drivers/gpu/drm/v3d/v3d_submit.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/v3d/v3d_submit.c b/drivers/gpu/drm/v3d/v3d_sub= mit.c index 7682b24f13ec..2b1dc92d4709 100644 --- a/drivers/gpu/drm/v3d/v3d_submit.c +++ b/drivers/gpu/drm/v3d/v3d_submit.c @@ -127,11 +127,8 @@ v3d_render_job_free(struct kref *ref) } =20 static void -v3d_cpu_job_free(struct kref *ref) +v3d_cpu_job_free_resources(struct v3d_cpu_job *job) { - struct v3d_cpu_job *job =3D container_of(ref, struct v3d_cpu_job, - base.refcount); - v3d_timestamp_query_info_free(&job->timestamp_query, job->timestamp_query.count); =20 @@ -140,7 +137,15 @@ v3d_cpu_job_free(struct kref *ref) =20 if (job->indirect_csd.indirect) drm_gem_object_put(job->indirect_csd.indirect); +} + +static void +v3d_cpu_job_free(struct kref *ref) +{ + struct v3d_cpu_job *job =3D container_of(ref, struct v3d_cpu_job, + base.refcount); =20 + v3d_cpu_job_free_resources(job); v3d_job_free(ref); } =20 @@ -1313,6 +1318,7 @@ v3d_submit_cpu_ioctl(struct drm_device *dev, void *da= ta, ret =3D v3d_get_extensions(file_priv, args->extensions, &se, cpu_job); if (ret) { drm_dbg(dev, "Failed to get extensions.\n"); + v3d_cpu_job_free_resources(cpu_job); goto fail; } } @@ -1320,12 +1326,14 @@ v3d_submit_cpu_ioctl(struct drm_device *dev, void *= data, /* Every CPU job must have a CPU job user extension */ if (!cpu_job->job_type) { drm_dbg(dev, "CPU job must have a CPU job user extension.\n"); + v3d_cpu_job_free_resources(cpu_job); ret =3D -EINVAL; goto fail; } =20 if (args->bo_handle_count !=3D cpu_job_bo_handle_count[cpu_job->job_type]= ) { drm_dbg(dev, "This CPU job was not submitted with the proper number of B= Os.\n"); + v3d_cpu_job_free_resources(cpu_job); ret =3D -EINVAL; goto fail; } @@ -1335,6 +1343,7 @@ v3d_submit_cpu_ioctl(struct drm_device *dev, void *da= ta, ret =3D v3d_job_init(v3d, file_priv, &cpu_job->base, v3d_cpu_job_free, 0, &se, V3D_CPU); if (ret) { + v3d_cpu_job_free_resources(cpu_job); v3d_job_deallocate((void *)&cpu_job); goto fail; } --=20 2.43.0