Thread (2 messages) 2 messages, 2 authors, 27d ago

Re: [PATCH 4/4] crypto: tegra - fix host1x job leak in tegra_se_host1x_submit()

flat view

From: Mikko Perttunen <mperttunen@nvidia.com>
Date: 2026-09-15 05:58:03
Also in: linux-tegra, lkml, stable

On Tuesday, September 15, 2026 1:14 PM Wentao Liang wrote:
quoted hunk ↗ jump to hunk
If host1x_syncpt_wait() fails, e.g. when the job times out,
tegra_se_host1x_submit() returns without calling host1x_job_put(),
leaking the reference taken by host1x_job_alloc() together with the
syncpt reference held by the job.

Jump to the existing job_unpin label so the job is unpinned and put on
the wait failure path as well.

Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <redacted>
---
 drivers/crypto/tegra/tegra-se-main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/tegra/tegra-se-main.c b/drivers/crypto/tegra/tegra-se-main.c
index eb71113ed146..1afbe5eb90af 100644
--- a/drivers/crypto/tegra/tegra-se-main.c
+++ b/drivers/crypto/tegra/tegra-se-main.c
@@ -180,7 +180,7 @@ int tegra_se_host1x_submit(struct tegra_se *se, struct tegra_se_cmdbuf *cmdbuf,
 				 MAX_SCHEDULE_TIMEOUT, NULL);
 	if (ret) {
 		dev_err(se->dev, "host1x job timed out\n");
-		return ret;
+		goto job_unpin;
 	}
 
 	host1x_job_put(job);
-- 
2.34.1
This won't apply on linux-next, because you already fixed this issue 
(correctly; jumping to unpin is incorrect since after submit the host1x 
driver owns those resources).

Mikko


Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help