[PATCH v2 4/4] drm/panfrost: Don't destroy uninitialized entities of a new JM context

[Jiwoo Kim <arpe1618@gmail.com>]

When panfrost_jm_ctx_create() fails, it drops its reference to the new
context, and panfrost_jm_ctx_release() then calls
drm_sched_entity_destroy() on all the entities of the context. If the
requested priority is invalid or not allowed, or drm_sched_entity_init()
fails, some or all of these entities have never been initialized,
though. Since commit fd177135f0e6 ("drm/sched: Account entity GPU
time"), drm_sched_entity_fini() then dereferences the NULL entity->stats
of such an entity, and since commit 2df5efb45425 ("drm/sched: Remove
redundant entity->rq initialization and checks"),
drm_sched_entity_flush() already dereferences its NULL entity->rq.
Userspace can hit this with JM_CTX_CREATE and an invalid priority.

On these error paths, destroy only the entities that were initialized
and free the context directly. The context is only put once it is fully
set up.

The patch and its changelog were drafted with an AI coding assistant.
The issue has not been reproduced, and the change has only been
compile-tested.

Fixes: 6aa8bc58ac88 ("drm/panfrost: Introduce JM contexts for manging job resources")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-1f36c24e-a878-442e-991c-1b387017bee6
Signed-off-by: Jiwoo Kim <arpe1618@gmail.com>
---
 drivers/gpu/drm/panfrost/panfrost_job.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/panfrost/panfrost_job.c b/drivers/gpu/drm/panfrost/panfrost_job.c
index 0dbed7a50910..95fd9521016d 100644
--- a/drivers/gpu/drm/panfrost/panfrost_job.c
+++ b/drivers/gpu/drm/panfrost/panfrost_job.c
@@ -1097,6 +1097,7 @@ int panfrost_jm_ctx_create(struct drm_file *file,
 	struct panfrost_device *pfdev = priv->pfdev;
 	enum drm_sched_priority sched_prio;
 	struct panfrost_jm_ctx *jm_ctx;
+	u32 i;
 	int ret;
 
 	jm_ctx = kzalloc_obj(*jm_ctx);
@@ -1107,15 +1108,15 @@ int panfrost_jm_ctx_create(struct drm_file *file,
 
 	ret = jm_ctx_prio_to_drm_sched_prio(file, args->priority, &sched_prio);
 	if (ret)
-		goto err_put_jm_ctx;
+		goto err_free_jm_ctx;
 
-	for (u32 i = 0; i < NUM_JOB_SLOTS; i++) {
+	for (i = 0; i < NUM_JOB_SLOTS; i++) {
 		struct drm_gpu_scheduler *sched = &pfdev->js->queue[i].sched;
 
 		ret = drm_sched_entity_init(&jm_ctx->slot_entity[i], sched_prio,
 					    &sched, 1, NULL);
 		if (ret)
-			goto err_put_jm_ctx;
+			goto err_destroy_entities;
 	}
 
 	ret = xa_alloc(&priv->jm_ctxs, &args->handle, jm_ctx,
@@ -1129,6 +1130,13 @@ int panfrost_jm_ctx_create(struct drm_file *file,
 	jm_ctx->destroyed = true;
 	panfrost_jm_ctx_put(jm_ctx);
 	return ret;
+
+err_destroy_entities:
+	while (i--)
+		drm_sched_entity_destroy(&jm_ctx->slot_entity[i]);
+err_free_jm_ctx:
+	kfree(jm_ctx);
+	return ret;
 }
 
 int panfrost_jm_ctx_destroy(struct drm_file *file, u32 handle)
-- 
2.43.0