From mboxrd@z Thu Jan 1 00:00:00 1970 From: Daniel Vetter Date: Thu, 24 Oct 2019 12:38:53 +0000 Subject: Re: [PATCH][next] drm/v3d: fix double free of bin Message-Id: <20191024123853.GH11828@phenom.ffwll.local> List-Id: References: <20191024104801.3122-1-colin.king@canonical.com> In-Reply-To: <20191024104801.3122-1-colin.king@canonical.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Colin King Cc: David Airlie , Daniel Vetter , kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, Iago Toral Quiroga , Navid Emamdoost On Thu, Oct 24, 2019 at 11:48:01AM +0100, Colin King wrote: > From: Colin Ian King > > Two different fixes have addressed the same memory leak of bin and > this now causes a double free of bin. While the individual memory > leak fixes are fine, both fixes together are problematic. > > Addresses-Coverity: ("Double free") > Fixes: 29cd13cfd762 ("drm/v3d: Fix memory leak in v3d_submit_cl_ioctl") > Fixes: 0d352a3a8a1f (" rm/v3d: don't leak bin job if v3d_job_init fails.") > Signed-off-by: Colin Ian King That sounds like wrong merge resolution somewhere, and we don't have those patches merged together in any final tree yet anywhere. What's this based on? -Daniel > --- > drivers/gpu/drm/v3d/v3d_gem.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c > index 549dde83408b..37515e47b47e 100644 > --- a/drivers/gpu/drm/v3d/v3d_gem.c > +++ b/drivers/gpu/drm/v3d/v3d_gem.c > @@ -568,7 +568,6 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data, > ret = v3d_job_init(v3d, file_priv, &bin->base, > v3d_job_free, args->in_sync_bcl); > if (ret) { > - kfree(bin); > v3d_job_put(&render->base); > kfree(bin); > return ret; > -- > 2.20.1 > -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch From mboxrd@z Thu Jan 1 00:00:00 1970 From: Daniel Vetter Subject: Re: [PATCH][next] drm/v3d: fix double free of bin Date: Thu, 24 Oct 2019 14:38:53 +0200 Message-ID: <20191024123853.GH11828@phenom.ffwll.local> References: <20191024104801.3122-1-colin.king@canonical.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mail-wr1-x444.google.com (mail-wr1-x444.google.com [IPv6:2a00:1450:4864:20::444]) by gabe.freedesktop.org (Postfix) with ESMTPS id 4CEEA6E3A4 for ; Thu, 24 Oct 2019 12:38:57 +0000 (UTC) Received: by mail-wr1-x444.google.com with SMTP id w18so25365759wrt.3 for ; Thu, 24 Oct 2019 05:38:57 -0700 (PDT) Content-Disposition: inline In-Reply-To: <20191024104801.3122-1-colin.king@canonical.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Colin King Cc: David Airlie , Daniel Vetter , kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, Iago Toral Quiroga , Navid Emamdoost List-Id: dri-devel@lists.freedesktop.org T24gVGh1LCBPY3QgMjQsIDIwMTkgYXQgMTE6NDg6MDFBTSArMDEwMCwgQ29saW4gS2luZyB3cm90 ZToKPiBGcm9tOiBDb2xpbiBJYW4gS2luZyA8Y29saW4ua2luZ0BjYW5vbmljYWwuY29tPgo+IAo+ IFR3byBkaWZmZXJlbnQgZml4ZXMgaGF2ZSBhZGRyZXNzZWQgdGhlIHNhbWUgbWVtb3J5IGxlYWsg b2YgYmluIGFuZAo+IHRoaXMgbm93IGNhdXNlcyBhIGRvdWJsZSBmcmVlIG9mIGJpbi4gIFdoaWxl IHRoZSBpbmRpdmlkdWFsIG1lbW9yeQo+IGxlYWsgZml4ZXMgYXJlIGZpbmUsIGJvdGggZml4ZXMg dG9nZXRoZXIgYXJlIHByb2JsZW1hdGljLgo+IAo+IEFkZHJlc3Nlcy1Db3Zlcml0eTogKCJEb3Vi bGUgZnJlZSIpCj4gRml4ZXM6IDI5Y2QxM2NmZDc2MiAoImRybS92M2Q6IEZpeCBtZW1vcnkgbGVh ayBpbiB2M2Rfc3VibWl0X2NsX2lvY3RsIikKPiBGaXhlczogMGQzNTJhM2E4YTFmICgiIHJtL3Yz ZDogZG9uJ3QgbGVhayBiaW4gam9iIGlmIHYzZF9qb2JfaW5pdCBmYWlscy4iKQo+IFNpZ25lZC1v ZmYtYnk6IENvbGluIElhbiBLaW5nIDxjb2xpbi5raW5nQGNhbm9uaWNhbC5jb20+CgpUaGF0IHNv dW5kcyBsaWtlIHdyb25nIG1lcmdlIHJlc29sdXRpb24gc29tZXdoZXJlLCBhbmQgd2UgZG9uJ3Qg aGF2ZSB0aG9zZQpwYXRjaGVzIG1lcmdlZCB0b2dldGhlciBpbiBhbnkgZmluYWwgdHJlZSB5ZXQg YW55d2hlcmUuIFdoYXQncyB0aGlzIGJhc2VkCm9uPwotRGFuaWVsCgo+IC0tLQo+ICBkcml2ZXJz L2dwdS9kcm0vdjNkL3YzZF9nZW0uYyB8IDEgLQo+ICAxIGZpbGUgY2hhbmdlZCwgMSBkZWxldGlv bigtKQo+IAo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL2dwdS9kcm0vdjNkL3YzZF9nZW0uYyBiL2Ry aXZlcnMvZ3B1L2RybS92M2QvdjNkX2dlbS5jCj4gaW5kZXggNTQ5ZGRlODM0MDhiLi4zNzUxNWU0 N2I0N2UgMTAwNjQ0Cj4gLS0tIGEvZHJpdmVycy9ncHUvZHJtL3YzZC92M2RfZ2VtLmMKPiArKysg Yi9kcml2ZXJzL2dwdS9kcm0vdjNkL3YzZF9nZW0uYwo+IEBAIC01NjgsNyArNTY4LDYgQEAgdjNk X3N1Ym1pdF9jbF9pb2N0bChzdHJ1Y3QgZHJtX2RldmljZSAqZGV2LCB2b2lkICpkYXRhLAo+ICAJ CXJldCA9IHYzZF9qb2JfaW5pdCh2M2QsIGZpbGVfcHJpdiwgJmJpbi0+YmFzZSwKPiAgCQkJCSAg IHYzZF9qb2JfZnJlZSwgYXJncy0+aW5fc3luY19iY2wpOwo+ICAJCWlmIChyZXQpIHsKPiAtCQkJ a2ZyZWUoYmluKTsKPiAgCQkJdjNkX2pvYl9wdXQoJnJlbmRlci0+YmFzZSk7Cj4gIAkJCWtmcmVl KGJpbik7Cj4gIAkJCXJldHVybiByZXQ7Cj4gLS0gCj4gMi4yMC4xCj4gCgotLSAKRGFuaWVsIFZl dHRlcgpTb2Z0d2FyZSBFbmdpbmVlciwgSW50ZWwgQ29ycG9yYXRpb24KaHR0cDovL2Jsb2cuZmZ3 bGwuY2gKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZHJp LWRldmVsIG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBz Oi8vbGlzdHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRldmVs From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.1 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F19ACA9EAF for ; Thu, 24 Oct 2019 12:39:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id F166521655 for ; Thu, 24 Oct 2019 12:39:01 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=ffwll.ch header.i=@ffwll.ch header.b="OC7T25s1" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2501961AbfJXMjA (ORCPT ); Thu, 24 Oct 2019 08:39:00 -0400 Received: from mail-wr1-f65.google.com ([209.85.221.65]:33584 "EHLO mail-wr1-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727154AbfJXMi7 (ORCPT ); Thu, 24 Oct 2019 08:38:59 -0400 Received: by mail-wr1-f65.google.com with SMTP id s1so17136138wro.0 for ; Thu, 24 Oct 2019 05:38:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; h=sender:date:from:to:cc:subject:message-id:mail-followup-to :references:mime-version:content-disposition:in-reply-to:user-agent; bh=DJ9YPx7+n1PCdyUhZ2dP1UoOL9smelF9iCjqcb3ACuQ=; b=OC7T25s1P6P+UU4+3mI+CNjv0Ku6/AuM5iNGxza+4kgK+zIgYufjMaQgvJdsHJ8Sr2 MdDenmU891PzzJpPKN6NhBcOOlQEtUQXxu/FPHDFBBC9FQrCVtbsXgxBELTZ6F5XC/ax nMpELi2hZ20KJDv3LvlzfxBVWH0CHLXa1ta0A= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:from:to:cc:subject:message-id :mail-followup-to:references:mime-version:content-disposition :in-reply-to:user-agent; bh=DJ9YPx7+n1PCdyUhZ2dP1UoOL9smelF9iCjqcb3ACuQ=; b=bR0C9jg8ZFybzdyWx1jpjB0hxtxgKjAbC02z5NLajcZrMSygY2JmrBWLn5C0NeL8Xk Yik5oaAnc9vA3CpXsbtVt8DzVy8tC14HfiWydsQns8lZVGWhGvm9pKF8D1h7YDQbQtjq +ia5dChrxFZALZCQqk2Tfz6o/xyI7by5u4nJd0vOdSxoOI5gmSHYetTd8Fg1WjFwhaZf OJF+G/T6vzrPo1WmBZs6vcdFA34HPmApF9D3DuC7JNLGkwEgpI3M7Mc+3gvKSI6d5tuM q/aUqMCx/F2z9lBG34crl22ZD5CqqNC+GURIt6mBX3aYARuXivGaRzftyTvcnX4ZUEVm Tlag== X-Gm-Message-State: APjAAAXBWhgSq9LYyPqXD42aHWZUnRY5/YBwZD62EE1no9YwLco87bWg fD8zHRrkh6rB8MdKBoIjNlCUGw== X-Google-Smtp-Source: APXvYqzJz9HtesuNFtknXFUbo5uGWFpCON0/JuQdLXmV+NUQ5T2p0OSvCdnTHV2dFr2Z4sMGd+CjlQ== X-Received: by 2002:adf:d190:: with SMTP id v16mr3844066wrc.64.1571920735886; Thu, 24 Oct 2019 05:38:55 -0700 (PDT) Received: from phenom.ffwll.local (212-51-149-96.fiber7.init7.net. [212.51.149.96]) by smtp.gmail.com with ESMTPSA id l6sm2465278wmg.2.2019.10.24.05.38.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Oct 2019 05:38:54 -0700 (PDT) Date: Thu, 24 Oct 2019 14:38:53 +0200 From: Daniel Vetter To: Colin King Cc: Eric Anholt , David Airlie , Daniel Vetter , Navid Emamdoost , Iago Toral Quiroga , dri-devel@lists.freedesktop.org, kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH][next] drm/v3d: fix double free of bin Message-ID: <20191024123853.GH11828@phenom.ffwll.local> Mail-Followup-To: Colin King , Eric Anholt , David Airlie , Navid Emamdoost , Iago Toral Quiroga , dri-devel@lists.freedesktop.org, kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org References: <20191024104801.3122-1-colin.king@canonical.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20191024104801.3122-1-colin.king@canonical.com> X-Operating-System: Linux phenom 5.2.0-2-amd64 User-Agent: Mutt/1.10.1 (2018-07-13) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Oct 24, 2019 at 11:48:01AM +0100, Colin King wrote: > From: Colin Ian King > > Two different fixes have addressed the same memory leak of bin and > this now causes a double free of bin. While the individual memory > leak fixes are fine, both fixes together are problematic. > > Addresses-Coverity: ("Double free") > Fixes: 29cd13cfd762 ("drm/v3d: Fix memory leak in v3d_submit_cl_ioctl") > Fixes: 0d352a3a8a1f (" rm/v3d: don't leak bin job if v3d_job_init fails.") > Signed-off-by: Colin Ian King That sounds like wrong merge resolution somewhere, and we don't have those patches merged together in any final tree yet anywhere. What's this based on? -Daniel > --- > drivers/gpu/drm/v3d/v3d_gem.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c > index 549dde83408b..37515e47b47e 100644 > --- a/drivers/gpu/drm/v3d/v3d_gem.c > +++ b/drivers/gpu/drm/v3d/v3d_gem.c > @@ -568,7 +568,6 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data, > ret = v3d_job_init(v3d, file_priv, &bin->base, > v3d_job_free, args->in_sync_bcl); > if (ret) { > - kfree(bin); > v3d_job_put(&render->base); > kfree(bin); > return ret; > -- > 2.20.1 > -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch