[PATCH] drm/v3d: Fix double free of query arrays when extension parsing fails

[PATCH] drm/v3d: Fix double free of query arrays when extension parsing fails

[Wang Xiaolei]

v3d_get_cpu_timestamp_query_params() and v3d_copy_query_info() - the
latter used by both performance query parsers - free the query array on
their error paths through v3d_timestamp_query_info_free() /
v3d_performance_query_info_free(), but leave query_info->queries
pointing at the freed buffer.

The same job is then released by v3d_submit_cpu_ioctl()'s failure path
(v3d_submit_cleanup_jobs() -> v3d_job_cleanup() -> v3d_job_put() ->
v3d_cpu_job_free()), which calls the same helpers on the same
query_info. On these error paths query_info->count was never assigned -
it is only written after the parsing loop completes - so the syncobj
loop runs zero times and no syncobj is put twice, but the
"if (query_info->queries)" test still succeeds and the dangling pointer
is handed to kvfree() a second time.

Every failure inside the parsing loop takes this path: -ENOENT from
drm_syncobj_find(), -EFAULT from get_user(), or -ENOMEM from
kvmalloc_array() in v3d_copy_query_info(). The helpers are shared
between that error path and the job release path.

Clear the pointer once the buffer has been freed.

Fixes: 0e50fcc20bd8 ("drm/v3d: Fix potential memory leak in the timestamp extension")
Fixes: 32df4abc44f2 ("drm/v3d: Fix potential memory leak in the performance extension")
Cc: stable@vger.kernel.org
Cc: Maíra Canal <mcanal@igalia.com>
Cc: Iago Toral Quiroga <itoral@igalia.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Signed-off-by: Wang Xiaolei <wangxiaolei01@kaihong.com>
---
 drivers/gpu/drm/v3d/v3d_sched.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c
index 1924e3440dc9..a96023b5dce0 100644
--- a/drivers/gpu/drm/v3d/v3d_sched.c
+++ b/drivers/gpu/drm/v3d/v3d_sched.c
@@ -106,6 +106,7 @@ v3d_timestamp_query_info_free(struct v3d_timestamp_query_info *query_info,
 			drm_syncobj_put(query_info->queries[i].syncobj);
 
 		kvfree(query_info->queries);
+		query_info->queries = NULL;
 	}
 }
 
@@ -122,6 +123,7 @@ v3d_performance_query_info_free(struct v3d_performance_query_info *query_info,
 		}
 
 		kvfree(query_info->queries);
+		query_info->queries = NULL;
 	}
 }
 
-- 
2.34.1