From nobody Mon Sep 28 23:07:53 2026 Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E79683AAF69 for ; Sat, 15 Aug 2026 14:59:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786805961; cv=none; b=MQ/70xPa0rD65vgPQxChiOHc5hb0ZGhs53DODX5fXU7sYeDdKUzghcbewzqx4imb1CHsyRAKZMZ5+NaVCllbpIBCiTRvJyI3/1urtbOoJhrQmwYQfY14GMsI4PfWVL7vyBb8oUQsC/1xJLRKyi0gEqtwzFsBADXPZXkOo+tLmaM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786805961; c=relaxed/simple; bh=hzPZ7/kMFfYPJqfR7nQm8nUAVNSLABD3zpPB6iBojYM=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=lXSRU9bYTSqP6lvfmWxmSJ+XFdGt35AweuNOCyzuBDn/sLFhLQM8+pl9jSn80OPmZrG/flH6RZvraqV6T8cet7oMSAxygtlqgmiKcAEsCrGwtXd2fBkan9uuhZoYAosZjfbcburKErWPW/xJ9pw0K3IOrzDFsvlINgb3Mbl5+ig= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=LzQvtdVT; arc=none smtp.client-ip=209.85.128.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="LzQvtdVT" Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-490cf322ed0so18638395e9.1 for ; Sat, 15 Aug 2026 07:59:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786805958; x=1787410758; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Wx5BkprMSKmCIjYgcc1kdDlxBMJZQro9c/22It8R+Vk=; b=LzQvtdVTRlYtSvve8G8NWEJRysFMs6ifrtAQmbGR9i0aK8NhPmbb2h3rwaxkAdo2++ VW1NH5DtxCr4A3BSFvbsnJiR1FNGNE43La9D8YqF5WLY+oi33J1ASopXJm6nD9kZ/Fbf wAOsVKhhHrP/KqjASTER6bhHk2wkcZ7QQvqK9LZDZwFFE+5UEvmLjhcEGgnFUA6cCdEG I5wBbsasjwiM15fGgZlapfxoiPh5wI8FUAL7XekR0IEpBgDW0N/Nbrike37AmUilkPhk ANw0YbXrP+Aa7feQ5vVSprF2PwjLdejtxo2LbKu+4TpyP6q1BhsdCI6CsPbxdCjWwDn+ yt1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786805958; x=1787410758; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Wx5BkprMSKmCIjYgcc1kdDlxBMJZQro9c/22It8R+Vk=; b=dPlVCyzVShSKELqQxDtpgF1rnrAoEycrc/WqCV/Uz57itct/ZcvypvDm9TsJHtEl9E obH1YjSlbdf293USPeomwZ+UlSBQjoxzuuyDgpWjpEUr52erV5RuiTYABtcx8D0LeSJJ rMwMCtn2TA/hMuTmHJ4nNWNoPIpCZco5nVnPuIraR/y4c4njje8vkSRolxZijX/z9B9s Svf3Hh2+zWq7WakcFceWgEbkEtmXEogOKDEReoPiBppYH1ScF/SMg36CG/bpHBMXmFqI KzLAS6CFJ0XvRj3MjxEkiOct4iykuiejJYbvrv4WFEw0buraTN/SYyUi1KejLsL0H0UW 1CeQ== X-Forwarded-Encrypted: i=1; AHgh+Rp7nENqITc/wTShNcMQegqz1q/mqXBfJDu3tgqiESuaQz0Upxp0TBhrncutZNSBHNrtaYHAh2SWRO/Zl4k=@vger.kernel.org X-Gm-Message-State: AOJu0YxC7UC8nAHBh/67BfK+59kvw16eP80n2aO6JYwM1LHhyac+8WvV K0N4aeX9atKRDJm9BQ1C/KW3IUB2QQ3mFKjuZNkp1lBtVSAiE6PQg8hs X-Gm-Gg: AR+sD10jaoImIJhRCVo0WPU/VWA04vuDwVmVgc+U+UiXxF6OVznN00hP5Q/+p0G8Yj7 8h3Gy+BefNCRvnzGogKKgeazIgfgoPzo87rfixNIeZ37Csm1Bbnyi+mSC6e3y+wo+71LnWtLfo9 5mJIX56UxPrXWXJ1TxaVBysHK+1r4d36di1fIiCxlbJG3V+2a8A/sUOC1vDKfF8HfbvWv9Fb3bO fA/98XRvajsWyANmcshFaHp/dyF9NKYZHBLNvz1D2D0IO9K2TeancedS6gliaul/lKlCYvn+thz 6R2e4oCe4k/o/ZVU/fqIciOQK9cxF2YxCAkiUzbTKyOyGwDF6oLxItASRVyhP6AL+CrQ/eRYJFo JjLkiGXir4DNGgP9kw/6AOs7w069R8+U+3oY+c5deVTrDhmnum0kMehLfufNfavDmQb0kgxZgQm rUYHcL388Gr8xnvra+a9zalPR0yd660188ye96UXBbcrxQYzHMgYOSwzYEbH06rzMUkKdb0RuZN cJoqjMehmTdu7OVbD4138ZGP5CquQQEGRiCapdNbrdaLxo+kqvUSoyLXV4hZz1cQDSUHBzyrXod 90rklpcTiJChyi3j/Ud0Xl13N+fCivIL8ec4uydeuBxzOCs7T+8z7wBnU4wF0p/pFC5o X-Received: by 2002:a05:600c:3485:b0:499:726a:a017 with SMTP id 5b1f17b1804b1-49987938e19mr207043855e9.1.1786805957923; Sat, 15 Aug 2026 07:59:17 -0700 (PDT) Received: from localhost.localdomain (dynamic-2a02-3100-aecb-d601-fc34-eb31-14a1-3704.310.pool.telefonica.de. [2a02:3100:aecb:d601:fc34:eb31:14a1:3704]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-499899b5f86sm119605645e9.5.2026.08.15.07.59.16 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 15 Aug 2026 07:59:17 -0700 (PDT) From: Karl Mehltretter To: Melissa Wen , =?UTF-8?q?Ma=C3=ADra=20Canal?= Cc: Karl Mehltretter , Iago Toral Quiroga , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH] drm/v3d: Fix NULL pointer dereference in CPU job cleanup Date: Sat, 15 Aug 2026 16:59:14 +0200 Message-Id: <20260815145914.84154-1-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" v3d_submit_cpu_ioctl() allocates cpu_job before initializing its embedded drm_sched_job. If extension parsing fails, no CPU job extension is supplied, or the BO count is invalid, it jumps to fail before v3d_job_init(). v3d_job_cleanup() then calls drm_sched_job_cleanup() with a NULL s_fence, causing a NULL pointer dereference. An empty DRM_IOCTL_V3D_SUBMIT_CPU (flags =3D=3D 0) is sufficient to trigger= it. Deallocate the job and clear the pointer on these paths, matching the existing handling when v3d_job_init() fails. v3d_job_deallocate() frees only the top-level job. If extension parsing already allocated query or indirect-CSD state, that state still leaks on these error paths, turning the former oops into a repeatable leak. Fixing this safely is more involved and beyond the scope of this fix. This patch therefore addresses only the crash. Fixes: aafc1a2bea674 ("drm/v3d: Add a CPU job submission") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Karl Mehltretter --- Tested on a Raspberry Pi 400: the unpatched kernel oopses on flags=3D0; with this patch the ioctl returns -EINVAL without an oops. drivers/gpu/drm/v3d/v3d_submit.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/v3d/v3d_submit.c b/drivers/gpu/drm/v3d/v3d_sub= mit.c index 7682b24f13ec5..304950ba42a38 100644 --- a/drivers/gpu/drm/v3d/v3d_submit.c +++ b/drivers/gpu/drm/v3d/v3d_submit.c @@ -1313,6 +1313,7 @@ v3d_submit_cpu_ioctl(struct drm_device *dev, void *da= ta, ret =3D v3d_get_extensions(file_priv, args->extensions, &se, cpu_job); if (ret) { drm_dbg(dev, "Failed to get extensions.\n"); + v3d_job_deallocate((void *)&cpu_job); goto fail; } } @@ -1321,12 +1322,14 @@ v3d_submit_cpu_ioctl(struct drm_device *dev, void *= data, if (!cpu_job->job_type) { drm_dbg(dev, "CPU job must have a CPU job user extension.\n"); ret =3D -EINVAL; + v3d_job_deallocate((void *)&cpu_job); goto fail; } =20 if (args->bo_handle_count !=3D cpu_job_bo_handle_count[cpu_job->job_type]= ) { drm_dbg(dev, "This CPU job was not submitted with the proper number of B= Os.\n"); ret =3D -EINVAL; + v3d_job_deallocate((void *)&cpu_job); goto fail; } =20 --=20 2.53.0