CVE-2025-38189

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Avoid NULL pointer dereference in v3d_job_update_stats()

The following kernel Oops was recently reported by Mesa CI:

[ 800.139824] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000588 [ 800.148619] Mem abort info: [ 800.151402] ESR = 0x0000000096000005 [ 800.155141] EC = 0x25: DABT (current EL), IL = 32 bits [ 800.160444] SET = 0, FnV = 0 [ 800.163488] EA = 0, S1PTW = 0 [ 800.166619] FSC = 0x05: level 1 translation fault [ 800.171487] Data abort info: [ 800.174357] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 800.179832] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 800.184873] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 800.190176] user pgtable: 4k pages, 39-bit VAs, pgdp=00000001014c2000 [ 800.196607] [0000000000000588] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 800.205305] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 800.211564] Modules linked in: vc4 sndsochdmicodec drmdisplayhelper v3d cec gpusched drmdmahelper drmshmemhelper drmkmshelper drm drmpanelorientationquirks sndsoccore sndcompress sndpcmdmaengine sndpcm i2cbrcmstb sndtimer snd backlight [ 800.234448] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1 Debian 1:6.12.25-1+rpt1 [ 800.244182] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT) [ 800.250005] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 800.256959] pc : v3djobupdatestats+0x60/0x130 [v3d] [ 800.262112] lr : v3djobupdatestats+0x48/0x130 [v3d] [ 800.267251] sp : ffffffc080003e60 [ 800.270555] x29: ffffffc080003e60 x28: ffffffd842784980 x27: 0224012000000000 [ 800.277687] x26: ffffffd84277f630 x25: ffffff81012fd800 x24: 0000000000000020 [ 800.284818] x23: ffffff8040238b08 x22: 0000000000000570 x21: 0000000000000158 [ 800.291948] x20: 0000000000000000 x19: ffffff8040238000 x18: 0000000000000000 [ 800.299078] x17: ffffffa8c1bd2000 x16: ffffffc080000000 x15: 0000000000000000 [ 800.306208] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 800.313338] x11: 0000000000000040 x10: 0000000000001a40 x9 : ffffffd83b39757c [ 800.320468] x8 : ffffffd842786420 x7 : 7fffffffffffffff x6 : 0000000000ef32b0 [ 800.327598] x5 : 00ffffffffffffff x4 : 0000000000000015 x3 : ffffffd842784980 [ 800.334728] x2 : 0000000000000004 x1 : 0000000000010002 x0 : 000000ba4c0ca382 [ 800.341859] Call trace: [ 800.344294] v3djobupdatestats+0x60/0x130 [v3d] [ 800.349086] v3dirq+0x124/0x2e0 [v3d] [ 800.352835] _handleirqeventpercpu+0x58/0x218 [ 800.357539] handleirqevent+0x54/0xb8 [ 800.361369] handlefasteoiirq+0xac/0x240 [ 800.365458] handleirqdesc+0x48/0x68 [ 800.369200] generichandledomainirq+0x24/0x38 [ 800.373810] gichandleirq+0x48/0xd8 [ 800.377464] callonirqstack+0x24/0x58 [ 800.381379] dointerrupthandler+0x88/0x98 [ 800.385554] el1interrupt+0x34/0x68 [ 800.389123] el1h64irqhandler+0x18/0x28 [ 800.393211] el1h64irq+0x64/0x68 [ 800.396603] defaultidlecall+0x3c/0x168 [ 800.400606] doidle+0x1fc/0x230 [ 800.403827] cpustartupentry+0x40/0x50 [ 800.407742] restinit+0xe4/0xf0 [ 800.410962] startkernel+0x5e8/0x790 [ 800.414616] _primaryswitched+0x80/0x90 [ 800.418622] Code: 8b170277 8b160296 11000421 b9000861 (b9401ac1) [ 800.424707] ---[ end trace 0000000000000000 ]--- [ 800.457313] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---

This issue happens when the file descriptor is closed before the jobs submitted by it are completed. When the job completes, we update the global GPU stats and the per-fd GPU stats, which are exposed through fdinfo. If the file descriptor was closed, then the struct v3d_file_priv and its stats were already freed and we can't update the per-fd stats.

Therefore, if the file descriptor was already closed, don't u ---truncated---