[PATCH] accel/ethosu: Fix use-after-free and memory leak in ioctl_submit_job

[Wentao Liang]

Two bugs exist in ethosu_ioctl_submit_job():

1. Use-after-free via NULL pointer dereference: When done_fence
   allocation fails, the error path jumps to out_cleanup_job which calls
   drm_sched_job_cleanup() on an uninitialized struct, dereferencing the
   NULL s_fence pointer.

2. Memory leak of done_fence: The done_fence struct is allocated
   separately with kzalloc() but is never freed on any error path that
   occurs after successful allocation (including drm_sched_job_init
   failure, BO lookup failures, etc.). It cannot be freed via
   dma_fence_put() because dma_fence_init() is not called until
   ethosu_job_run().

Fix by:
- Changing the done_fence allocation failure goto target from
  out_cleanup_job to out_put_job, which skips the uninitialized
  drm_sched_job_cleanup() call.
- Adding kfree(job->done_fence) in ethosu_job_err_cleanup() to ensure
  the separately allocated fence struct is released on all error paths.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver")
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/accel/ethosu/ethosu_job.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethosu_job.c
index ec85f4156744..9a8164a54454 100644
--- a/drivers/accel/ethosu/ethosu_job.c
+++ b/drivers/accel/ethosu/ethosu_job.c
@@ -150,6 +150,7 @@ static void ethosu_job_err_cleanup(struct ethosu_job *job)
 	for (i = 0; i < job->region_cnt; i++)
 		drm_gem_object_put(job->region_bo[i]);
 
+	kfree(job->done_fence);
 	drm_gem_object_put(job->cmd_bo);
 
 	kfree(job);
@@ -393,7 +394,7 @@ static int ethosu_ioctl_submit_job(struct drm_device *dev, struct drm_file *file
 	ejob->done_fence = kzalloc_obj(*ejob->done_fence);
 	if (!ejob->done_fence) {
 		ret = -ENOMEM;
-		goto out_cleanup_job;
+		goto out_put_job;
 	}
 
 	ret = drm_sched_job_init(&ejob->base,
-- 
2.39.5 (Apple Git-154)