From: Lukas Wunner <lukas@wunner.de>
To: intel-gfx@lists.freedesktop.org
Cc: Jani Nikula <jani.nikula@intel.com>
Subject: [PATCH v5 2/2] drm/i915: On fb alloc failure, unref gem object where it gets refed
Date: Sat, 4 Jul 2015 11:50:58 +0200 [thread overview]
Message-ID: <521e48fc5fc8d211ed2847070120ff4032b7a383.1441363361.git.lukas@wunner.de> (raw)
In-Reply-To: <f0cd66427039ce1bdc61460a9d833e6d858cff3e.1441363361.git.lukas@wunner.de>
Currently when allocating a framebuffer fails, the gem object gets
unrefed at the bottom of the call chain in __intel_framebuffer_create,
not where it gets refed, which is in intel_framebuffer_create_for_mode
(via i915_gem_alloc_object) and in intel_user_framebuffer_create
(via drm_gem_object_lookup).
This invites mistakes: As discovered by Tvrtko Ursulin, a double unref
has sneaked into intelfb_alloc (which calls __intel_framebuffer_create).
As suggested by Ville Syrjälä, improve code clarity by moving the unref
away from __intel_framebuffer_create to where the gem object gets refed.
[Changelog is in preceding patch by Tvrtko Ursulin.]
Tested-by: Pierre Moreau <pierre.morrow@free.fr>
[MBP 5,3 2009 nvidia 9400M + 9600M GT pre-retina]
Tested-by: Paul Hordiienko <pvt.gord@gmail.com>
[MBP 6,2 2010 intel ILK + nvidia GT216 pre-retina]
Tested-by: William Brown <william@blackhats.net.au>
[MBP 8,2 2011 intel SNB + amd turks pre-retina]
Tested-by: Lukas Wunner <lukas@wunner.de>
[MBP 9,1 2012 intel IVB + nvidia GK107 pre-retina]
Tested-by: Bruno Bierbaumer <bruno@bierbaumer.net>
[MBP 11,3 2013 intel HSW + nvidia GK107 retina]
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Fixes: a8bb6818270c ("drm/i915: Fix error path leak in fbdev fb
allocation")
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
---
drivers/gpu/drm/i915/intel_display.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 421ac15..68d051d 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -10033,20 +10033,17 @@ __intel_framebuffer_create(struct drm_device *dev,
int ret;
intel_fb = kzalloc(sizeof(*intel_fb), GFP_KERNEL);
- if (!intel_fb) {
- drm_gem_object_unreference(&obj->base);
+ if (!intel_fb)
return ERR_PTR(-ENOMEM);
- }
ret = intel_framebuffer_init(dev, intel_fb, mode_cmd, obj);
if (ret)
goto err;
return &intel_fb->base;
+
err:
- drm_gem_object_unreference(&obj->base);
kfree(intel_fb);
-
return ERR_PTR(ret);
}
@@ -10086,6 +10083,7 @@ intel_framebuffer_create_for_mode(struct drm_device *dev,
struct drm_display_mode *mode,
int depth, int bpp)
{
+ struct drm_framebuffer *fb;
struct drm_i915_gem_object *obj;
struct drm_mode_fb_cmd2 mode_cmd = { 0 };
@@ -10100,7 +10098,11 @@ intel_framebuffer_create_for_mode(struct drm_device *dev,
bpp);
mode_cmd.pixel_format = drm_mode_legacy_fb_format(bpp, depth);
- return intel_framebuffer_create(dev, &mode_cmd, obj);
+ fb = intel_framebuffer_create(dev, &mode_cmd, obj);
+ if (IS_ERR(fb))
+ drm_gem_object_unreference_unlocked(&obj->base);
+
+ return fb;
}
static struct drm_framebuffer *
@@ -14289,6 +14291,7 @@ intel_user_framebuffer_create(struct drm_device *dev,
struct drm_file *filp,
struct drm_mode_fb_cmd2 *mode_cmd)
{
+ struct drm_framebuffer *fb;
struct drm_i915_gem_object *obj;
obj = to_intel_bo(drm_gem_object_lookup(dev, filp,
@@ -14296,7 +14299,11 @@ intel_user_framebuffer_create(struct drm_device *dev,
if (&obj->base == NULL)
return ERR_PTR(-ENOENT);
- return intel_framebuffer_create(dev, mode_cmd, obj);
+ fb = intel_framebuffer_create(dev, mode_cmd, obj);
+ if (IS_ERR(fb))
+ drm_gem_object_unreference_unlocked(&obj->base);
+
+ return fb;
}
#ifndef CONFIG_DRM_FBDEV_EMULATION
--
2.1.0
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx
next prev parent reply other threads:[~2015-09-04 14:01 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-06-30 9:06 [PATCH v5 1/2] drm/i915: Fix failure paths around initial fbdev allocation Lukas Wunner
2015-07-04 9:50 ` Lukas Wunner [this message]
2015-10-13 15:39 ` [PATCH v5 2/2] drm/i915: On fb alloc failure, unref gem object where it gets refed Ville Syrjälä
2015-10-13 15:04 ` [PATCH v5 1/2] drm/i915: Fix failure paths around initial fbdev allocation Ville Syrjälä
2015-10-14 9:35 ` Chris Wilson
2015-10-15 17:14 ` Lukas Wunner
2015-10-15 17:22 ` Daniel Vetter
2015-10-15 17:34 ` Ville Syrjälä
2015-10-18 18:03 ` Lukas Wunner
2015-10-25 11:14 ` [PATCH v6 0/4] fbdev deadlock & failure path fixes Lukas Wunner
2015-06-30 9:06 ` [PATCH v6 3/4] drm/i915: Fix failure paths around initial fbdev allocation Lukas Wunner
2015-10-30 18:28 ` Daniel Vetter
2015-11-07 10:41 ` [PATCH v7 0/3] fbdev fixes (reviewed) Lukas Wunner
2015-06-30 9:06 ` [PATCH v7 3/3] drm/i915: Fix failure paths around initial fbdev allocation Lukas Wunner
2015-07-04 9:50 ` [PATCH v7 1/3] drm/i915: On fb alloc failure, unref gem object where it gets refed Lukas Wunner
2015-10-22 11:37 ` [PATCH v7 2/3] drm/i915: Fix double unref in intelfb_alloc failure path Lukas Wunner
2015-11-09 14:23 ` [PATCH v7 0/3] fbdev fixes (reviewed) Jani Nikula
2015-11-12 19:20 ` Lukas Wunner
2015-11-13 7:06 ` Jani Nikula
2015-11-17 13:44 ` Daniel Vetter
2015-07-04 9:50 ` [PATCH v6 1/4] drm/i915: On fb alloc failure, unref gem object where it gets refed Lukas Wunner
2015-10-22 11:37 ` [PATCH v6 2/4] drm/i915: Fix double unref in intelfb_alloc failure path Lukas Wunner
2015-10-30 18:17 ` Daniel Vetter
2015-10-23 22:27 ` [PATCH v6 4/4] drm/i915: Fix error handling in intelfb_create Lukas Wunner
2015-10-30 18:23 ` Daniel Vetter
2015-11-08 12:56 ` [PATCH v2 0/2] fbdev fixes (need review) Lukas Wunner
2015-11-03 7:00 ` [PATCH v2 2/2] drm/i915: Tear down fbdev if initialization fails Lukas Wunner
2015-11-05 9:42 ` [PATCH v2 1/2] drm/i915: Fix oops caused by fbdev initialization failure Lukas Wunner
2015-11-17 13:51 ` [PATCH v2 0/2] fbdev fixes (need review) Daniel Vetter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=521e48fc5fc8d211ed2847070120ff4032b7a383.1441363361.git.lukas@wunner.de \
--to=lukas@wunner.de \
--cc=intel-gfx@lists.freedesktop.org \
--cc=jani.nikula@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.