The exec array contains one entry for each userspace object. eb_parse()
can append internal VMAs by increasing buffer_count after relocation
arrays have been copied only for the original userspace entries.

The cleanup path currently uses the enlarged count and can index beyond
the copied exec array. Preserve the original userspace count and use it
when freeing copied relocation arrays.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
index 65ce54b20ec2..b991f4e82ae6 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
@@ -1768,6 +1768,7 @@ static int eb_reinit_userptr(struct i915_execbuffer *eb)
 
 static noinline int eb_relocate_parse_slow(struct i915_execbuffer *eb)
 {
+	const unsigned int exec_count = eb->buffer_count;
 	bool have_copy = false;
 	struct eb_vma *ev;
 	int err = 0;
@@ -1870,10 +1871,10 @@ static noinline int eb_relocate_parse_slow(struct i915_execbuffer *eb)
 
 out:
 	if (have_copy) {
-		const unsigned int count = eb->buffer_count;
 		unsigned int i;
 
-		for (i = 0; i < count; i++) {
+		/* eb_parse() may append internal VMAs without appending eb->exec. */
+		for (i = 0; i < exec_count; i++) {
 			const struct drm_i915_gem_exec_object2 *entry =
 				&eb->exec[i];
 			struct drm_i915_gem_relocation_entry *relocs;
-- 
2.43.0