Thread (2 messages) 2 messages, 2 authors, 21d ago

[PATCH 4/4] crypto: tegra - fix host1x job leak in tegra_se_host1x_submit()

COLD21d

From: Wentao Liang <hidden>
Date: 2026-09-15 04:15:04
Also in: linux-tegra, lkml, stable
Subsystem: crypto api, tegra crypto drivers, the rest · Maintainers: Herbert Xu, "David S. Miller", Akhil R, Linus Torvalds

If host1x_syncpt_wait() fails, e.g. when the job times out,
tegra_se_host1x_submit() returns without calling host1x_job_put(),
leaking the reference taken by host1x_job_alloc() together with the
syncpt reference held by the job.

Jump to the existing job_unpin label so the job is unpinned and put on
the wait failure path as well.

Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <redacted>
---
 drivers/crypto/tegra/tegra-se-main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/tegra/tegra-se-main.c b/drivers/crypto/tegra/tegra-se-main.c
index eb71113ed146..1afbe5eb90af 100644
--- a/drivers/crypto/tegra/tegra-se-main.c
+++ b/drivers/crypto/tegra/tegra-se-main.c
@@ -180,7 +180,7 @@ int tegra_se_host1x_submit(struct tegra_se *se, struct tegra_se_cmdbuf *cmdbuf,
 				 MAX_SCHEDULE_TIMEOUT, NULL);
 	if (ret) {
 		dev_err(se->dev, "host1x job timed out\n");
-		return ret;
+		goto job_unpin;
 	}
 
 	host1x_job_put(job);
-- 
2.34.1
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help