From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E346F28EB for ; Mon, 30 Jan 2023 14:06:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3EF74C433D2; Mon, 30 Jan 2023 14:06:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1675087566; bh=WDeKM/8hT4upI98m8Tu4RR4xYnAVlAnBW3nPYgSqTO0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LntvXhBSJAaP+7MYNg2i5cZNt3my6a9PGjSawML5QAtKnm2Zk5M05UPtqA30xskBE u5PsAaprAcny2uT342oivtuEf3OzsU5HrQetKlJfZ5EnKlkupr3oQ9ndHdH20l8Swc 4w3/bM6YY83HEzFAoXQipA7Y9Ztf2pF9Bs5dA138= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Tvrtko Ursulin , Andi Shyti , Nirmoy Das , Chuansheng Liu , Mirsad Todorovac , Tvrtko Ursulin , Maxime Ripard , Sasha Levin Subject: [PATCH 6.1 251/313] drm/i915: Fix a memory leak with reused mmap_offset Date: Mon, 30 Jan 2023 14:51:26 +0100 Message-Id: <20230130134348.402494797@linuxfoundation.org> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230130134336.532886729@linuxfoundation.org> References: <20230130134336.532886729@linuxfoundation.org> User-Agent: quilt/0.67 Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Nirmoy Das [ Upstream commit 0220e4fe178c3390eb0291cdb34912d66972db8a ] drm_vma_node_allow() and drm_vma_node_revoke() should be called in balanced pairs. We call drm_vma_node_allow() once per-file everytime a user calls mmap_offset, but only call drm_vma_node_revoke once per-file on each mmap_offset. As the mmap_offset is reused by the client, the per-file vm_count may remain non-zero and the rbtree leaked. Call drm_vma_node_allow_once() instead to prevent that memory leak. Cc: Tvrtko Ursulin Cc: Andi Shyti Signed-off-by: Nirmoy Das Fixes: 786555987207 ("drm/i915/gem: Store mmap_offsets in an rbtree rather than a plain list") Reported-by: Chuansheng Liu Reported-by: Mirsad Todorovac Reviewed-by: Tvrtko Ursulin Reviewed-by: Andi Shyti Link: https://lore.kernel.org/r/20230117175236.22317-2-nirmoy.das@intel.com Signed-off-by: Maxime Ripard Signed-off-by: Sasha Levin --- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/i915_gem_mman.c index 354c1d6dab84..d445e2d63c9c 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c @@ -697,7 +697,7 @@ mmap_offset_attach(struct drm_i915_gem_object *obj, GEM_BUG_ON(lookup_mmo(obj, mmap_type) != mmo); out: if (file) - drm_vma_node_allow(&mmo->vma_node, file); + drm_vma_node_allow_once(&mmo->vma_node, file); return mmo; err: -- 2.39.0