Hi Sasha, please notice that there were two separate patches that addressed the same issue and applying both simultaneously leads to a double free (which is what I see is happening with this patch: see the second call to kfree(bin) right below the one added here). This issue was raised previously here: https://lists.freedesktop.org/archives/dri-devel/2019-October/241425.html Iago On Thu, 2020-01-16 at 11:39 -0500, Sasha Levin wrote: > From: Iago Toral Quiroga <itoral@xxxxxxxxxx> > > [ Upstream commit 0d352a3a8a1f26168d09f7073e61bb4b328e3bb9 ] > > If the initialization of the job fails we need to kfree() it > before returning. > > Signed-off-by: Iago Toral Quiroga <itoral@xxxxxxxxxx> > Signed-off-by: Eric Anholt <eric@xxxxxxxxxx> > Link: > https://patchwork.freedesktop.org/patch/msgid/20190916071125.5255-1-itoral@xxxxxxxxxx > Fixes: a783a09ee76d ("drm/v3d: Refactor job management.") > Reviewed-by: Eric Anholt <eric@xxxxxxxxxx> > Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> > --- > drivers/gpu/drm/v3d/v3d_gem.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/gpu/drm/v3d/v3d_gem.c > b/drivers/gpu/drm/v3d/v3d_gem.c > index 19c092d75266..6316bf3646af 100644 > --- a/drivers/gpu/drm/v3d/v3d_gem.c > +++ b/drivers/gpu/drm/v3d/v3d_gem.c > @@ -565,6 +565,7 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void > *data, > ret = v3d_job_init(v3d, file_priv, &bin->base, > v3d_job_free, args->in_sync_bcl); > if (ret) { > + kfree(bin); > v3d_job_put(&render->base); > kfree(bin); > return ret;
