* [PATCH 4/4] crypto: tegra - fix host1x job leak in tegra_se_host1x_submit()
@ 2026-09-15 4:14 Wentao Liang
2026-09-15 5:57 ` Mikko Perttunen
0 siblings, 1 reply; 2+ messages in thread
From: Wentao Liang @ 2026-09-15 4:14 UTC (permalink / raw)
To: akhilrajeev
Cc: davem, herbert, jonathanh, linux-crypto, linux-kernel,
linux-tegra, thierry.reding, lkml, Wentao Liang, stable
If host1x_syncpt_wait() fails, e.g. when the job times out,
tegra_se_host1x_submit() returns without calling host1x_job_put(),
leaking the reference taken by host1x_job_alloc() together with the
syncpt reference held by the job.
Jump to the existing job_unpin label so the job is unpinned and put on
the wait failure path as well.
Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
drivers/crypto/tegra/tegra-se-main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/tegra/tegra-se-main.c b/drivers/crypto/tegra/tegra-se-main.c
index eb71113ed146..1afbe5eb90af 100644
--- a/drivers/crypto/tegra/tegra-se-main.c
+++ b/drivers/crypto/tegra/tegra-se-main.c
@@ -180,7 +180,7 @@ int tegra_se_host1x_submit(struct tegra_se *se, struct tegra_se_cmdbuf *cmdbuf,
MAX_SCHEDULE_TIMEOUT, NULL);
if (ret) {
dev_err(se->dev, "host1x job timed out\n");
- return ret;
+ goto job_unpin;
}
host1x_job_put(job);
--
2.34.1
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH 4/4] crypto: tegra - fix host1x job leak in tegra_se_host1x_submit()
2026-09-15 4:14 [PATCH 4/4] crypto: tegra - fix host1x job leak in tegra_se_host1x_submit() Wentao Liang
@ 2026-09-15 5:57 ` Mikko Perttunen
0 siblings, 0 replies; 2+ messages in thread
From: Mikko Perttunen @ 2026-09-15 5:57 UTC (permalink / raw)
To: akhilrajeev, Wentao Liang
Cc: davem, herbert, jonathanh, linux-crypto, linux-kernel,
linux-tegra, thierry.reding, lkml, Wentao Liang, stable
On Tuesday, September 15, 2026 1:14 PM Wentao Liang wrote:
> If host1x_syncpt_wait() fails, e.g. when the job times out,
> tegra_se_host1x_submit() returns without calling host1x_job_put(),
> leaking the reference taken by host1x_job_alloc() together with the
> syncpt reference held by the job.
>
> Jump to the existing job_unpin label so the job is unpinned and put on
> the wait failure path as well.
>
> Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
> drivers/crypto/tegra/tegra-se-main.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/crypto/tegra/tegra-se-main.c b/drivers/crypto/tegra/tegra-se-main.c
> index eb71113ed146..1afbe5eb90af 100644
> --- a/drivers/crypto/tegra/tegra-se-main.c
> +++ b/drivers/crypto/tegra/tegra-se-main.c
> @@ -180,7 +180,7 @@ int tegra_se_host1x_submit(struct tegra_se *se, struct tegra_se_cmdbuf *cmdbuf,
> MAX_SCHEDULE_TIMEOUT, NULL);
> if (ret) {
> dev_err(se->dev, "host1x job timed out\n");
> - return ret;
> + goto job_unpin;
> }
>
> host1x_job_put(job);
> --
> 2.34.1
>
>
This won't apply on linux-next, because you already fixed this issue
(correctly; jumping to unpin is incorrect since after submit the host1x
driver owns those resources).
Mikko
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-15 5:58 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-15 4:14 [PATCH 4/4] crypto: tegra - fix host1x job leak in tegra_se_host1x_submit() Wentao Liang
2026-09-15 5:57 ` Mikko Perttunen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®