Re: [PATCH 4/4] crypto: tegra - fix host1x job leak in tegra_se_host1x_submit()

[Mikko Perttunen]

On Tuesday, September 15, 2026 1:14 PM Wentao Liang wrote:
> If host1x_syncpt_wait() fails, e.g. when the job times out,
> tegra_se_host1x_submit() returns without calling host1x_job_put(),
> leaking the reference taken by host1x_job_alloc() together with the
> syncpt reference held by the job.
> 
> Jump to the existing job_unpin label so the job is unpinned and put on
> the wait failure path as well.
> 
> Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> ---
>  drivers/crypto/tegra/tegra-se-main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/crypto/tegra/tegra-se-main.c b/drivers/crypto/tegra/tegra-se-main.c
> index eb71113ed146..1afbe5eb90af 100644
> --- a/drivers/crypto/tegra/tegra-se-main.c
> +++ b/drivers/crypto/tegra/tegra-se-main.c
> @@ -180,7 +180,7 @@ int tegra_se_host1x_submit(struct tegra_se *se, struct tegra_se_cmdbuf *cmdbuf,
>  				 MAX_SCHEDULE_TIMEOUT, NULL);
>  	if (ret) {
>  		dev_err(se->dev, "host1x job timed out\n");
> -		return ret;
> +		goto job_unpin;
>  	}
>  
>  	host1x_job_put(job);
> -- 
> 2.34.1
> 
> 

This won't apply on linux-next, because you already fixed this issue 
(correctly; jumping to unpin is incorrect since after submit the host1x 
driver owns those resources).

Mikko