v3d_get_cpu_timestamp_query_params() and v3d_copy_query_info() - the latter used by both performance query parsers - free the query array on their error paths through v3d_timestamp_query_info_free() / v3d_performance_query_info_free(), but leave query_info->queries pointing at the freed buffer. The same job is then released by v3d_submit_cpu_ioctl()'s failure path (v3d_submit_cleanup_jobs() -> v3d_job_cleanup() -> v3d_job_put() -> v3d_cpu_job_free()), which calls the same helpers on the same query_info. On these error paths query_info->count was never assigned - it is only written after the parsing loop completes - so the syncobj loop runs zero times and no syncobj is put twice, but the "if (query_info->queries)" test still succeeds and the dangling pointer is handed to kvfree() a second time. Every failure inside the parsing loop takes this path: -ENOENT from drm_syncobj_find(), -EFAULT from get_user(), or -ENOMEM from kvmalloc_array() in v3d_copy_query_info(). The helpers are shared between that error path and the job release path. Clear the pointer once the buffer has been freed. Fixes: 0e50fcc20bd8 ("drm/v3d: Fix potential memory leak in the timestamp extension") Fixes: 32df4abc44f2 ("drm/v3d: Fix potential memory leak in the performance extension") Cc: stable@vger.kernel.org Cc: Maíra Canal Cc: Iago Toral Quiroga Cc: Tvrtko Ursulin Signed-off-by: Wang Xiaolei --- drivers/gpu/drm/v3d/v3d_sched.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c index 1924e3440dc9..a96023b5dce0 100644 --- a/drivers/gpu/drm/v3d/v3d_sched.c +++ b/drivers/gpu/drm/v3d/v3d_sched.c @@ -106,6 +106,7 @@ v3d_timestamp_query_info_free(struct v3d_timestamp_query_info *query_info, drm_syncobj_put(query_info->queries[i].syncobj); kvfree(query_info->queries); + query_info->queries = NULL; } } @@ -122,6 +123,7 @@ v3d_performance_query_info_free(struct v3d_performance_query_info *query_info, } kvfree(query_info->queries); + query_info->queries = NULL; } } -- 2.34.1