diff options
| author |   Maíra Canal <mcanal@igalia.com> | 2026-05-15 12:07:15 -0300 |
|---|---|---|
| committer | Maíra Canal <mcanal@igalia.com> | 2026-05-18 19:59:51 -0300 |
| commit | 6eb6e5acafa46854d4363e6c34981289995f3ace (patch) | |
| tree | 8699eeb524b532a0d78ee44b58bda13a22df34d9 /include/linux/bcma/ssh:/git@git.zx2c4.com | |
| parent | drm/v3d: Fix use-after-free of CPU job query arrays on error path (diff) | |
drm/v3d: Release indirect CSD GEM reference on CPU job free
v3d_get_cpu_indirect_csd_params() takes a reference to the indirect BO via
drm_gem_object_lookup() and stashes it in cpu_job->indirect_csd.indirect,
but nothing on the CPU job teardown path ever drops that reference.
Drop the extra reference in v3d_cpu_job_free(). The NULL check covers ioctl
errors before the lookup ran and CPU job types other than
V3D_CPU_JOB_TYPE_INDIRECT_CSD, which leave the field zero-initialised.
Cc: stable@vger.kernel.org
Fixes: 18b8413b25b7 ("drm/v3d: Create a CPU job extension for a indirect CSD job")
Assisted-by: Claude:claude-opus-4.7
Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
Link: https://patch.msgid.link/20260515-v3d-cpu-job-leaks-v1-2-7f147cbbf935@igalia.com
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Diffstat (limited to 'include/linux/bcma/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions