From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 17DF4411A01 for ; Wed, 29 Jul 2026 15:57:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785340623; cv=none; b=gnJCW7CuuHRPQX0xZLCZ3ZRPVoUfd1hIlg2lqTPg0kcF88H1iIEj4SEEs3rM4ylsDJ6ncNdlzNThEd5G2nRwJ9IeFdWHGyIAuSD4CeYtlDZq72zzUBTGBQD0v+3HpEv0h0l5wDphnrPvSsZdbwsojNyLZtJJDtLxu8Tylq/21mw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785340623; c=relaxed/simple; bh=8PFfTxM13ahnT0/lEem0uzt2tuNNGVbRz+lfpQOxU8U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XCxqQNRBG+iD65mVnzM1CyoOpnIndubQWBAhS5bNsnYa1Jm7CpI4GvtTKci8K45vF5tQckHwzxgs48AG3enWGIl0/4h8kFbFv4NGUxIu5P+BdeaV+jkQN3NLoOPG3Y+Y16B9D+6tGjat6wkANYbjW74ua3eNe70HZWdtGWc4sB0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=kXHWtps/; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=IXMQ4cE8; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="kXHWtps/"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="IXMQ4cE8" Received: from pps.filterd (m0279873.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66TF3HWG2181900 for ; Wed, 29 Jul 2026 15:57:00 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=nr8Y2kLGOAQ fP+6If92MLZogonNmCXdm3m2GqTYBhjE=; b=kXHWtps//Rt18b9iSdW8msUMbV3 /yTPPMO/9q2Gw4dAShfKKmTJD+2aZ3Gj9N0v/GQ0cUCdmQvwiXyBxCz8aftN0Tiv 98C8qYyJ4cqe0iJ806MEU3IAgPi2Ar57kC/Dzpyjw7gd9R2/QHuYZKfgr9p7NXff AoHfHUfTaArwMMlUqfdJ+Zq3/LVm/NqBVpgTEEzeU09WDzITqi7J7Dabi9H81AxS of0H93OHa7AjNIer3S5IAVBCgPQVstNGmXGjHjR9Sdddrih0vvD/pWU5EjiVP4yk JKpvNZI/Rl063xqKgIlQvHKPtWBZ3j6TKFYYRzOyhnmv5lq2R2iN7oQKQ7Q== Received: from mail-pl1-f197.google.com (mail-pl1-f197.google.com [209.85.214.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fqhg8s4ka-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Wed, 29 Jul 2026 15:57:00 +0000 (GMT) Received: by mail-pl1-f197.google.com with SMTP id d9443c01a7336-2cfe48ca1efso16178075ad.0 for ; Wed, 29 Jul 2026 08:57:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1785340619; x=1785945419; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=nr8Y2kLGOAQfP+6If92MLZogonNmCXdm3m2GqTYBhjE=; b=IXMQ4cE8uFkcg9+doTTo0cjJo97yr10nCAt3tZUk9TQFgUH3zo9tAwl0sarxIBUuO1 FCq6KklNjoIm6mOlw1llFIaUe1qVuT7P8dXOKMHDR4mxZIOrcFsWgCkoByOXUTIuraY/ kRyT9OtOwJh1F4fXawEliwBt09LCSvHFa72v7NJUUyfRiUi4C1ocbVSBxU0VUE1qYIus azjyWSkypMc2a8mXYkM1pUnno7luN3Iw+iriCr/uZZeIoMw5nbxPzcDrCmpqm3ufbw8R cVlAKCIpQm4yWHcqbnt5f8UVd4MhfYSg7MDZjVVMb2Ls4EghJyLvXtRTZ5YTKLwm/JQv W9bQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785340619; x=1785945419; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=nr8Y2kLGOAQfP+6If92MLZogonNmCXdm3m2GqTYBhjE=; b=s7bHq33simAyqVDOTc5R7++zFxBInedINSZW04w3ySy1af3RGnukTUw/SjAh6LAi/D uYYVYotL9TA5CoPqpwMfkIcPuT27byeEw73lr98p6IZYcg6yoT4ehxdF//0xqy74wmmg VzKES4BeXfF3v1sSlM860BJcfkKjXdD08JLmwj/Nq3N4xO8dJGtABC7f1uO1pqfArgDv JZlZrSiMHKgft3Awyw8hjLjWynREfpzW2cWyCqaKsh9pZzd6CNSyl1nFnJGRuBldW/De AuXYrejz92E3Wxj4jkCmuINfqCyPZZPGOmPZWNjXSMcP/ZIw4MFs8bFCRnCG+KltyF0I JdEQ== X-Forwarded-Encrypted: i=1; AHgh+RrY4gH1HJh1H4HHo2kxzUvfdDYQqG39NIBRMIFKeb0NR3B3ayQ0S1jwhrK1Q2NdNx5XUpctHWYsHD3EiG8=@vger.kernel.org X-Gm-Message-State: AOJu0Yz9qgDX6ojkvNW/gzWlh3l0/BsOoBj2h02uWzn+WYKg4k/om/J9 7V1vMGyDx88fyL+fiHwbQcHdlS8Ql625RGduMPVRfMLPHAsrnCziqZjAmdgNcI8hQdRkWbNgmnS PI5BI0shJKKgANzoTO5tAaXVtO/6R2KQm5qenYCEmJc3OIWbGvDxkzzyeBi4ldNciR+I= X-Gm-Gg: AR+sD13oJ80Wbn62kNnxqwBn+W/SbwN67R0wbzUTTgyckoglPswqfF80Pms+en8mORW GlFgDKf60XVVViSHoAaC9jfSK0g/uYwgQ1qGrnt3+eyQnkzlecjaKTBJkaBvg4emYSex+gVAT+z xeZqwmg5S1e+DXPOVULswYqr25Rtpao4eosdgL1z7Sd5DqsY9gHUg7edKc0xMEMfzp/Bw8uf74Y Uw32LxTNddyvRoOXPobVkSRiZCUG9/1uRn8PMY90vDdY4UjVpYY2FpwE4zouVXD6bUpE1WJDjBq lSg76NJ+y7/GeFkoyAwS7wjWeSDQG3MhYa/b3rjjr7ZYWz+ZAQKZf6V/HY81Sfj8OfmKuQ4wzNG yez4AYA6/9nBpvhH7ho0yFyMd7Ng1+rz56W/x+HEOl8sH/xg= X-Received: by 2002:a17:903:291:b0:2cc:f4d4:299f with SMTP id d9443c01a7336-2d015ee2321mr87596325ad.27.1785340619609; Wed, 29 Jul 2026 08:56:59 -0700 (PDT) X-Received: by 2002:a17:903:291:b0:2cc:f4d4:299f with SMTP id d9443c01a7336-2d015ee2321mr87596035ad.27.1785340619194; Wed, 29 Jul 2026 08:56:59 -0700 (PDT) Received: from localhost (c-73-37-105-206.hsd1.or.comcast.net. [73.37.105.206]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d022a4af04sm14176905ad.31.2026.07.29.08.56.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 29 Jul 2026 08:56:58 -0700 (PDT) From: Rob Clark To: dri-devel@lists.freedesktop.org Cc: linux-arm-msm@vger.kernel.org, freedreno@lists.freedesktop.org, Rob Clark , Sashiko , Dmitry Baryshkov , Abhinav Kumar , Jessica Zhang , Sean Paul , Marijn Suijten , David Airlie , Simona Vetter , linux-kernel@vger.kernel.org (open list) Subject: [PATCH v7 05/17] drm/msm: Move nr_cmds initialization Date: Wed, 29 Jul 2026 08:55:42 -0700 Message-ID: <20260729155609.20190-6-robin.clark@oss.qualcomm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260729155609.20190-1-robin.clark@oss.qualcomm.com> References: <20260729155609.20190-1-robin.clark@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI5MDEyNyBTYWx0ZWRfX6sPqdJff37hQ CufcKEQJ2ghNs38nQjhmmjcD/wlX5xaGaA9pcHHvE1TIw2YmyU4kvBdtyjThfR6r9A++GfnZq81 BFgAvrpPGcN7WqBBuNgbBSJdatBRc5U= X-Proofpoint-GUID: Q2KPc9R5gZ4iWR5li2FAtqUm8l_bRmz7 X-Authority-Analysis: v=2.4 cv=LOdWhpW9 c=1 sm=1 tr=0 ts=6a6a22cc cx=c_pps a=cmESyDAEBpBGqyK7t0alAg==:117 a=19Wyn7e3V/0aNffMjNCMQw==:17 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=rJkE3RaqiGZ5pbrm-msn:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=F5a-vUUdUzRQ_IYq5r4A:9 a=1OuFwYUASf3TG4hYMiVC:22 X-Proofpoint-ORIG-GUID: Q2KPc9R5gZ4iWR5li2FAtqUm8l_bRmz7 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI5MDEyNyBTYWx0ZWRfX9J69XASlQTDP JmcZXT3CFQ/BwW9IH9105tBLrpZx+FH9UQMR/7KnTzHz2YWmtMV+8RONwY1leoo14JPh2in2cXG rQr7LJb3fdOGCiw1/pqXEoqsedZc+qF66k2876ALxcbyqD+ddlQZWW6gvECwt0nn1O/0XhY759/ JbQydsKdFaA1iiqRMZj/92RksuDv9mBRe/AYdAbbEoc36l5aYnaSmOyDIOhcrTQI03YUZUIhmfC 1vAMqQ4ZOfx91E5vJ3g3tgBIYxThOIWyi1Rrt9eBWsrhyfAgrf32kjJSokuGsi4uHtITV56xhbL XGCA33XprCfn98RNuOSSaWJ/86sg3zubQwWmGWXKQTXuyjAyNRg7eUdrzxkjN1yYGgehyxQinQc 6v7ZfHIq1wcj0V5MsxfAeFoJEwEjDF1CdO9US5NGVV/AmvRjtjykJxDGDYdQ/AnKAwPI1oZIk4Q iYn65VrGLT7+eL1yX3g== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-29_06,2026-07-29_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 impostorscore=0 suspectscore=0 adultscore=0 spamscore=0 phishscore=0 priorityscore=1501 lowpriorityscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607290127 Previously if we entered an error path between these two points, we could leak the relocs tables due to submit->nr_cmds still being zero. In practice, relocs are disallowed on a6xx+, and non-ancient userspace will not use relocs on earlier gens unless running on an ancient kernel. But userspace could use this to trigger a memory leak. Reported-by: Sashiko Signed-off-by: Rob Clark --- drivers/gpu/drm/msm/msm_gem_submit.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c index 3c6bc90c3d48..aa48ea4e7f58 100644 --- a/drivers/gpu/drm/msm/msm_gem_submit.c +++ b/drivers/gpu/drm/msm/msm_gem_submit.c @@ -260,6 +260,9 @@ static int submit_lookup_cmds(struct msm_gem_submit *submit, ret = -ENOMEM; goto out; } + + submit->nr_cmds = i + 1; + ret = copy_from_user(submit->cmd[i].relocs, userptr, sz); if (ret) { ret = -EFAULT; @@ -719,8 +722,6 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, goto out; } - submit->nr_cmds = args->nr_cmds; - idr_preload(GFP_KERNEL); spin_lock(&queue->idr_lock); -- 2.55.0