iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

A fix and a preliminary patch to fix a memory leak in i915, and a use

Browse Source 
after free fix for fbdev deferred io
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRcEzekXsqa64kGDp7j7w1vZxhRxQUCY9JYbwAKCRDj7w1vZxhR
 xT+PAQCA5ZOpDxVb4ZBKgggckxABiIJ6Ql480Oel7sJTlFudFwD+JfqDxMcOGe4F
 cq+xix1NYNN5bLKVEQONXsM9NpAwzgA=
 =bp8z
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2023-01-26' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

A fix and a preliminary patch to fix a memory leak in i915, and a use
after free fix for fbdev deferred io

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/20230126104018.cbrcjxl5wefdbb2f@houat
This commit is contained in:
Dave Airlie 2023-01-27 12:31:02 +10:00
commit d23db89883
5 changed files with 76 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/gpu/drm/drm_fbdev_generic.c
View File

@ -171,11 +171,6 @@ static const struct fb_ops drm_fbdev_fb_ops = {
.fb_imageblit = drm_fbdev_fb_imageblit,
};
static struct fb_deferred_io drm_fbdev_defio = {
.delay = HZ / 20,
.deferred_io = drm_fb_helper_deferred_io,
};
/*
* This function uses the client API to create a framebuffer backed by a dumb buffer.
*/
@ -222,8 +217,14 @@ static int drm_fbdev_fb_probe(struct drm_fb_helper *fb_helper,
return -ENOMEM;
fbi->flags |= FBINFO_VIRTFB | FBINFO_READS_FAST;
fbi->fbdefio = &drm_fbdev_defio;
fb_deferred_io_init(fbi);
/* Set a default deferred I/O handler */
fb_helper->fbdefio.delay = HZ / 20;
fb_helper->fbdefio.deferred_io = drm_fb_helper_deferred_io;
fbi->fbdefio = &fb_helper->fbdefio;
ret = fb_deferred_io_init(fbi);
if (ret)
return ret;
} else {
/* buffer is mapped for HW framebuffer */
ret = drm_client_buffer_vmap(fb_helper->buffer, &map);

76
drivers/gpu/drm/drm_vma_manager.c
View File

@ -240,27 +240,8 @@ void drm_vma_offset_remove(struct drm_vma_offset_manager *mgr,
}
EXPORT_SYMBOL(drm_vma_offset_remove);
/**
* drm_vma_node_allow - Add open-file to list of allowed users
* @node: Node to modify
* @tag: Tag of file to remove
*
* Add @tag to the list of allowed open-files for this node. If @tag is
* already on this list, the ref-count is incremented.
*
* The list of allowed-users is preserved across drm_vma_offset_add() and
* drm_vma_offset_remove() calls. You may even call it if the node is currently
* not added to any offset-manager.
*
* You must remove all open-files the same number of times as you added them
* before destroying the node. Otherwise, you will leak memory.
*
* This is locked against concurrent access internally.
*
* RETURNS:
* 0 on success, negative error code on internal failure (out-of-mem)
*/
int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag)
static int vma_node_allow(struct drm_vma_offset_node *node,
struct drm_file *tag, bool ref_counted)
{
struct rb_node **iter;
struct rb_node *parent = NULL;
@ -282,7 +263,8 @@ int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag)
entry = rb_entry(*iter, struct drm_vma_offset_file, vm_rb);
if (tag == entry->vm_tag) {
entry->vm_count++;
if (ref_counted)
entry->vm_count++;
goto unlock;
} else if (tag > entry->vm_tag) {
iter = &(*iter)->rb_right;
@ -307,8 +289,58 @@ unlock:
kfree(new);
return ret;
}
/**
* drm_vma_node_allow - Add open-file to list of allowed users
* @node: Node to modify
* @tag: Tag of file to remove
*
* Add @tag to the list of allowed open-files for this node. If @tag is
* already on this list, the ref-count is incremented.
*
* The list of allowed-users is preserved across drm_vma_offset_add() and
* drm_vma_offset_remove() calls. You may even call it if the node is currently
* not added to any offset-manager.
*
* You must remove all open-files the same number of times as you added them
* before destroying the node. Otherwise, you will leak memory.
*
* This is locked against concurrent access internally.
*
* RETURNS:
* 0 on success, negative error code on internal failure (out-of-mem)
*/
int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag)
{
return vma_node_allow(node, tag, true);
}
EXPORT_SYMBOL(drm_vma_node_allow);
/**
* drm_vma_node_allow_once - Add open-file to list of allowed users
* @node: Node to modify
* @tag: Tag of file to remove
*
* Add @tag to the list of allowed open-files for this node.
*
* The list of allowed-users is preserved across drm_vma_offset_add() and
* drm_vma_offset_remove() calls. You may even call it if the node is currently
* not added to any offset-manager.
*
* This is not ref-counted unlike drm_vma_node_allow() hence drm_vma_node_revoke()
* should only be called once after this.
*
* This is locked against concurrent access internally.
*
* RETURNS:
* 0 on success, negative error code on internal failure (out-of-mem)
*/
int drm_vma_node_allow_once(struct drm_vma_offset_node *node, struct drm_file *tag)
{
return vma_node_allow(node, tag, false);
}
EXPORT_SYMBOL(drm_vma_node_allow_once);
/**
* drm_vma_node_revoke - Remove open-file from list of allowed users
* @node: Node to modify

2
drivers/gpu/drm/i915/gem/i915_gem_mman.c
View File

@ -697,7 +697,7 @@ insert:
GEM_BUG_ON(lookup_mmo(obj, mmap_type) != mmo);
out:
if (file)
drm_vma_node_allow(&mmo->vma_node, file);
drm_vma_node_allow_once(&mmo->vma_node, file);
return mmo;
err:

12
include/drm/drm_fb_helper.h
View File

@ -208,6 +208,18 @@ struct drm_fb_helper {
* the smem_start field should always be cleared to zero.
*/
bool hint_leak_smem_start;
#ifdef CONFIG_FB_DEFERRED_IO
/**
* @fbdefio:
*
* Temporary storage for the driver's FB deferred I/O handler. If the
* driver uses the DRM fbdev emulation layer, this is set by the core
* to a generic deferred I/O handler if a driver is preferring to use
* a shadow buffer.
*/
struct fb_deferred_io fbdefio;
#endif
};
static inline struct drm_fb_helper *

1
include/drm/drm_vma_manager.h
View File

@ -74,6 +74,7 @@ void drm_vma_offset_remove(struct drm_vma_offset_manager *mgr,
struct drm_vma_offset_node *node);
int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag);
int drm_vma_node_allow_once(struct drm_vma_offset_node *node, struct drm_file *tag);
void drm_vma_node_revoke(struct drm_vma_offset_node *node,
struct drm_file *tag);
bool drm_vma_node_is_allowed(struct drm_vma_offset_node *node,