From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8238E368D6E for ; Fri, 17 Jul 2026 20:48:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784321344; cv=none; b=rmcL6zNjcX+5jdUYjwP5976KyjVwwrEdDftD9S6Gv3x1f5Om5sqV4PbalQbT4Ncuc9sFogPkU5DPRXYnuwVG1FBGHC4tPJzcMjeQa+Mya0y0WBs9QakHtv6Rbzz0N6YBJScGW0KhINPSJ7cbAQIcFj+CbgnKwY3M2njuGPfQOKU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784321344; c=relaxed/simple; bh=8PFfTxM13ahnT0/lEem0uzt2tuNNGVbRz+lfpQOxU8U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QKADboTTbiARUo4aQvFKSVZ/YTYRhGPL+Q8IGbc/+Bb2IDRQ0IHu/GuruzLeiEy8LaEZ/Yq5oBg1z3r2uMH97DKNaqRCKh+oDyk/K7JQSAI+xa1VFb0BGxRuzS90IJiQNoV2dOz4b7AhUFRDO0ZEjK9Ef7HsNTgZlBSwdewCRk4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=gLaCAxa0; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=cWYbGA4o; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="gLaCAxa0"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="cWYbGA4o" Received: from pps.filterd (m0279866.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66HJtCuK2597295 for ; Fri, 17 Jul 2026 20:48:58 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=nr8Y2kLGOAQ fP+6If92MLZogonNmCXdm3m2GqTYBhjE=; b=gLaCAxa0DW+ibkaCzTzroerrr0H Ymr6Rx48d/TcAGbSzUXU5xLAyTnM21jrvrRk3fWEzG5QVbuS0TlqAckcDBSFl9AS Zrh9uDnACNja0Z6NHwGg66o9B2/0IgVc7iTbTR8h3j2Tw6uzEbyu8NnZvnZAuKGF g9SFi/QWljv1QFYV3BtCipl0aDnIBFgTHYGs830wO+5N7n2KgMXXuzkbx414O0Av +0qT7ytiKswd96W+C2erXJ0m3OYX2MS3yCzXKDiZdobSQKoG5VeMglxl237U1hxp xbEgp8sk578SIJlETcDbWF48/m77wrrg1Pwl+twbqMbftIQtLGf50A9zRHg== Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4ffrp8rsfa-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 17 Jul 2026 20:48:57 +0000 (GMT) Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-2cacd6d37edso110721625ad.0 for ; Fri, 17 Jul 2026 13:48:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784321337; x=1784926137; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=nr8Y2kLGOAQfP+6If92MLZogonNmCXdm3m2GqTYBhjE=; b=cWYbGA4oFINfuLaiBhKqpSxFaySMtUgGqATnfQu3YCOQn86CDrUamxwpKxHrqsZ7id ujafwHqsJR/WtwpB5VAii9Ibnz7rs+Y17XlcNXkRa58BpZdIaFedKHFz2TWrVivvO8uh kqCbpTsKP9eQSnZ4MmDv+aPhzvvEdvd8cntHSN5EWchEFuXBg+wIujgWLFVRMSKlVGGI 8TLmpRPi7neDwfPdtCfFKgGDCddHOfSCDhqUjzDippMhwaVyz2Utle2zyaj1bCP+dkfJ pi8U/rHDYRdk1S8eqmaikAdDql4S+/vX06o6oiHXbvNHj6m9XpzEMMoDE4yLWY9rroep 4TRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784321337; x=1784926137; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=nr8Y2kLGOAQfP+6If92MLZogonNmCXdm3m2GqTYBhjE=; b=ivpBO0TaEytjVly4z5b2zaft8+a5qh3v0QKJUYQG7mze03hKx8GkLHLH+jdtPyKSjd AiiWANCjGZUpeKRv1wzABSO+LeMpuNogzFGxl2ahN7RKvBP8rQTEF9a8yXj7qfloF2qM pRI4K0G2v1quI9BD/FaRpMYPHizLSm4eFiI/AFeHQ1VV+8TE+e/SaSYbhANozj0ItA/V LqK/ZdZZkPica2dLcl9EpqWEqQrD4EDy/tl4cUETFnCcBWr+UyGO4CW0JQLrM7ROXcoi EH2WT9FJmneOrcC106e/6QigL7rSpmLf8Q6ztkETg6YUU3G2P/cpOaUiv4rt8lXESjwD F6Tg== X-Forwarded-Encrypted: i=1; AHgh+Ro1t00blvuuef1S6BXwwcQ0K391mnio9IKddUQT7/r60+bD/BLqsToj4EUVTWSor3+olfGXFpFl+FkkcwA=@vger.kernel.org X-Gm-Message-State: AOJu0YwQ5dCp2oBBZcLyMOF8tLfvqfmE6OcEedtXSMPeh2yeEXMnG2kB 20juDzdO6BNmC3sOHJV8cg5tA7m2+EGnS6MEbN3xsumj0XjNdEdgDnj3flnxXMYIZBvxvoMnYgg WZ1oYHvbGzlQbo9axC8A3JjvsyefvIkiPYawxVTCiUHbqs9p3O/9uEu+elsA6m5f4Otk= X-Gm-Gg: AfdE7cmf+Lb6PwfuHachTAhRuCcNrRUH9Ym4cl76KPQBbqDgg50YIKH7y+tq0wj1pw+ WyNn3lg4jiIqNh2BSO2LGMu3lcAcSSqZChwQKwIni9X9xT9FvcGHlNDVmMKdqZSA3FA/6Y0dRjt GOAsQSqXrdRZnxh/ZBqyfQ7MwtUJRe4BetGEfO7qm8cuQdZOB/uKiwYu6jWZ1CV95HIRGRLsfVx SffYcqCA28MRiJEIlQNM2UGSUqiV2Ie2GElJht7znVopPwehm5C0bI4sYch1W3FuFh09kZBpZcR Asgjt4bwLUYaXQ8aUp+4oXLpoaumv+kT7V9Il//5LYeBIIzJOhlccO8o1vEzIFxqNd7T77zEQVw El4LQizLy9SJeQ3/2lwTVBo81WcNFgKJO7M8tamUheepg8Gw= X-Received: by 2002:a17:902:ce84:b0:2c9:c991:3bf0 with SMTP id d9443c01a7336-2cf3484be47mr48915105ad.8.1784321336979; Fri, 17 Jul 2026 13:48:56 -0700 (PDT) X-Received: by 2002:a17:902:ce84:b0:2c9:c991:3bf0 with SMTP id d9443c01a7336-2cf3484be47mr48914865ad.8.1784321336552; Fri, 17 Jul 2026 13:48:56 -0700 (PDT) Received: from localhost (c-73-37-105-206.hsd1.or.comcast.net. [73.37.105.206]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cf34729df7sm17187575ad.63.2026.07.17.13.48.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2026 13:48:56 -0700 (PDT) From: Rob Clark To: dri-devel@lists.freedesktop.org Cc: linux-arm-msm@vger.kernel.org, freedreno@lists.freedesktop.org, Rob Clark , Sashiko , Dmitry Baryshkov , Abhinav Kumar , Jessica Zhang , Sean Paul , Marijn Suijten , David Airlie , Simona Vetter , linux-kernel@vger.kernel.org (open list) Subject: [PATCH v6 05/16] drm/msm: Move nr_cmds initialization Date: Fri, 17 Jul 2026 13:48:21 -0700 Message-ID: <20260717204841.26120-6-robin.clark@oss.qualcomm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260717204841.26120-1-robin.clark@oss.qualcomm.com> References: <20260717204841.26120-1-robin.clark@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Proofpoint-Spam-Info: AW1haW4tMjYwNzE3MDIxNCBTYWx0ZWRfXynEhwJkzIjvb KLxNGG6AIVooFuP5EQzxUIIhycnilQMq9jopApyLobSnz+Kf7ASmbMr0RYa3FqSmNJ6Yjrtn/JD 840UcosR/84apsofZx7dbF9aKZea3wk= X-Proofpoint-ORIG-GUID: w9zhw6yyfbzP3fLNRW1f2BTacFaO3uaG X-Proofpoint-GUID: w9zhw6yyfbzP3fLNRW1f2BTacFaO3uaG X-Authority-Analysis: v=2.4 cv=fMYJG5ae c=1 sm=1 tr=0 ts=6a5a9539 cx=c_pps a=JL+w9abYAAE89/QcEU+0QA==:117 a=19Wyn7e3V/0aNffMjNCMQw==:17 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=YMgV9FUhrdKAYTUUvYB2:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=F5a-vUUdUzRQ_IYq5r4A:9 a=324X-CrmTo6CU4MGRt3R:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzE3MDIxNCBTYWx0ZWRfX4mZ3aarJz6MP g/KFjs1QBBMUnQSAIXjkzRQNfLkts57QMguwR3yLOc2BCC6hf7AgpD2sp6f3GyVO5NUG5e3bAGo 0xdDNm9oa2NDEbMJruXgprsGXNpdMfNpfxbmtJ9lCJvaCwgWitfQBsv/O0oraMVW/prGg0mJt70 kG7k6gi3yHV9zpPTnqzMK89nODWZx5Zvwu0FQNHbvGQxsOUPVAYWI3LSHa6Df2/Iz3xk0BvIgV8 RUHTErCA3si+raOOz4+XMWvHNIf2fA1lgrWaDAGzsf5V+HD6Hr4B3cD5uTA691/liJSvlyZMJsa 1+enwIrKU59rXqxVC1mbOnLRn1u9LIb7o82sTE+WZvj8t0km+dc60nGeGiFhmB6nXWvVC/qFv51 cj1MsJOKzE38mTL0capacgCfIbZNh+4Q9wKXlpDH8VifkOvDpkHjjEj+UYb00+SO65gzChZ9J9z fK6Z3S+TYSD7PqWwtbw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-17_06,2026-07-17_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 malwarescore=0 priorityscore=1501 suspectscore=0 lowpriorityscore=0 bulkscore=0 spamscore=0 adultscore=0 clxscore=1015 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607170214 Previously if we entered an error path between these two points, we could leak the relocs tables due to submit->nr_cmds still being zero. In practice, relocs are disallowed on a6xx+, and non-ancient userspace will not use relocs on earlier gens unless running on an ancient kernel. But userspace could use this to trigger a memory leak. Reported-by: Sashiko Signed-off-by: Rob Clark --- drivers/gpu/drm/msm/msm_gem_submit.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c index 3c6bc90c3d48..aa48ea4e7f58 100644 --- a/drivers/gpu/drm/msm/msm_gem_submit.c +++ b/drivers/gpu/drm/msm/msm_gem_submit.c @@ -260,6 +260,9 @@ static int submit_lookup_cmds(struct msm_gem_submit *submit, ret = -ENOMEM; goto out; } + + submit->nr_cmds = i + 1; + ret = copy_from_user(submit->cmd[i].relocs, userptr, sz); if (ret) { ret = -EFAULT; @@ -719,8 +722,6 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, goto out; } - submit->nr_cmds = args->nr_cmds; - idr_preload(GFP_KERNEL); spin_lock(&queue->idr_lock); -- 2.55.0