[PATCH] drm/msm: Fix error handling crashes seen when VRAM allocation fails

[PATCH] drm/msm: Fix error handling crashes seen when VRAM allocation fails

[Archit Taneja]

If VRAM allocation fails, the error handling path crashes in
msm_drm_uninit(). The following changes are made to fix this:

msm_gem_shrinker_cleanup() is fixed to unregister the shrinker only
if it was init-ed in the first place.

Before calling kms->funcs->destroy(), we check if kms->funcs is also
non-NULL. This is needed for MDP5, since during msm_drm_int(), priv->kms
becomes non-NULL early, but msm_kms_init() is called on it only later
in mdp5_kms_init().

Signed-off-by: Archit Taneja <architt@codeaurora.org>
---
 drivers/gpu/drm/msm/msm_drv.c          | 2 +-
 drivers/gpu/drm/msm/msm_gem_shrinker.c | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index fb5c0b0..46568fc 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -228,7 +228,7 @@ static int msm_drm_uninit(struct device *dev)
 	flush_workqueue(priv->atomic_wq);
 	destroy_workqueue(priv->atomic_wq);
 
-	if (kms)
+	if (kms && kms->funcs)
 		kms->funcs->destroy(kms);
 
 	if (gpu) {
diff --git a/drivers/gpu/drm/msm/msm_gem_shrinker.c b/drivers/gpu/drm/msm/msm_gem_shrinker.c
index 283d284..192b2d3 100644
--- a/drivers/gpu/drm/msm/msm_gem_shrinker.c
+++ b/drivers/gpu/drm/msm/msm_gem_shrinker.c
@@ -163,6 +163,9 @@ void msm_gem_shrinker_init(struct drm_device *dev)
 void msm_gem_shrinker_cleanup(struct drm_device *dev)
 {
 	struct msm_drm_private *priv = dev->dev_private;
-	WARN_ON(unregister_vmap_purge_notifier(&priv->vmap_notifier));
-	unregister_shrinker(&priv->shrinker);
+
+	if (priv->shrinker.nr_deferred) {
+		WARN_ON(unregister_vmap_purge_notifier(&priv->vmap_notifier));
+		unregister_shrinker(&priv->shrinker);
+	}
 }
-- 
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
hosted by The Linux Foundation

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH] drm/msm: Fix error handling crashes seen when VRAM allocation fails

[Andy Gross]

On Thu, Nov 03, 2016 at 05:36:18PM +0530, Archit Taneja wrote:
> If VRAM allocation fails, the error handling path crashes in
> msm_drm_uninit(). The following changes are made to fix this:
> 
> msm_gem_shrinker_cleanup() is fixed to unregister the shrinker only
> if it was init-ed in the first place.
> 
> Before calling kms->funcs->destroy(), we check if kms->funcs is also
> non-NULL. This is needed for MDP5, since during msm_drm_int(), priv->kms
> becomes non-NULL early, but msm_kms_init() is called on it only later
> in mdp5_kms_init().
> 
> Signed-off-by: Archit Taneja <architt@codeaurora.org>
> ---

Reviewed-by: Andy Gross <andy.gross@linaro.org>