From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Quanyang Wang <quanyang.wang@windriver.com>,
Daniel Vetter <daniel.vetter@ffwll.ch>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.10 18/23] drm/xlnx: fix kmemleak by sending vblank_event in atomic_disable
Date: Thu, 25 Feb 2021 10:53:49 +0100 [thread overview]
Message-ID: <20210225092517.401977784@linuxfoundation.org> (raw)
In-Reply-To: <20210225092516.531932232@linuxfoundation.org>
From: Quanyang Wang <quanyang.wang@windriver.com>
[ Upstream commit a7e02f7796c163ac8297b30223bf24bade9f8a50 ]
When running xrandr to change resolution of DP, the kmemleak as below
can be observed:
unreferenced object 0xffff00080a351000 (size 256):
comm "Xorg", pid 248, jiffies 4294899614 (age 19.960s)
hex dump (first 32 bytes):
98 a0 bc 01 08 00 ff ff 01 00 00 00 00 00 00 00 ................
ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e0bd0f69>] kmemleak_alloc+0x30/0x40
[<00000000cde2f318>] kmem_cache_alloc+0x3d4/0x588
[<0000000088ea9bd7>] drm_atomic_helper_setup_commit+0x84/0x5f8
[<000000002290a264>] drm_atomic_helper_commit+0x58/0x388
[<00000000f6ea78c3>] drm_atomic_commit+0x4c/0x60
[<00000000c8e0725e>] drm_atomic_connector_commit_dpms+0xe8/0x110
[<0000000020ade187>] drm_mode_obj_set_property_ioctl+0x1b0/0x450
[<00000000918206d6>] drm_connector_property_set_ioctl+0x3c/0x68
[<000000008d51e7a5>] drm_ioctl_kernel+0xc4/0x118
[<000000002a819b75>] drm_ioctl+0x214/0x448
[<000000008ca4e588>] __arm64_sys_ioctl+0xa8/0xf0
[<0000000034e15a35>] el0_svc_common.constprop.0+0x74/0x190
[<000000001b93d916>] do_el0_svc+0x24/0x90
[<00000000ce9230e0>] el0_svc+0x14/0x20
[<00000000e3607d82>] el0_sync_handler+0xb0/0xb8
[<000000003e79c15f>] el0_sync+0x174/0x180
This is because there is a scenario that a drm_crtc_commit commit is
allocated but not freed. The drm subsystem require/release references
to a CRTC commit by calling drm_crtc_commit_get/put, and when
drm_crtc_commit_put find that commit.ref.refcount is zero, it will
call __drm_crtc_commit_free to free this CRTC commit. Among these
drm_crtc_commit_get/put pairs, there is a drm_crtc_commit_get in
drm_atomic_helper_setup_commit as below:
...
new_crtc_state->event->base.completion = &commit->flip_done;
new_crtc_state->event->base.completion_release = release_crtc_commit;
drm_crtc_commit_get(commit);
...
This reference to the CRTC commit should be released at the function
release_crtc_commit by calling e->completion_release(e->completion) in
drm_send_event_locked. So we need to call drm_send_event_locked at
two places: handling vblank event in the irq handler and the crtc disable
helper. But in zynqmp_disp_crtc_atomic_disable, it only marks the flip
is done and not call drm_crtc_commit_put. This result that the refcount
of this commit is always non-zero and this commit will never be freed.
Since the function drm_crtc_send_vblank_event has operations both sending
a flip_done signal and releasing reference to the CRTC commit, let's use
it instead.
Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210202064121.173362-1-quanyang.wang@windriver.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xlnx/zynqmp_disp.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/xlnx/zynqmp_disp.c b/drivers/gpu/drm/xlnx/zynqmp_disp.c
index 98bd48f13fd11..8cd8af35cfaac 100644
--- a/drivers/gpu/drm/xlnx/zynqmp_disp.c
+++ b/drivers/gpu/drm/xlnx/zynqmp_disp.c
@@ -1398,19 +1398,11 @@ static void zynqmp_disp_enable(struct zynqmp_disp *disp)
*/
static void zynqmp_disp_disable(struct zynqmp_disp *disp)
{
- struct drm_crtc *crtc = &disp->crtc;
-
zynqmp_disp_audio_disable(&disp->audio);
zynqmp_disp_avbuf_disable_audio(&disp->avbuf);
zynqmp_disp_avbuf_disable_channels(&disp->avbuf);
zynqmp_disp_avbuf_disable(&disp->avbuf);
-
- /* Mark the flip is done as crtc is disabled anyway */
- if (crtc->state->event) {
- complete_all(crtc->state->event->base.completion);
- crtc->state->event = NULL;
- }
}
static inline struct zynqmp_disp *crtc_to_disp(struct drm_crtc *crtc)
@@ -1499,6 +1491,13 @@ zynqmp_disp_crtc_atomic_disable(struct drm_crtc *crtc,
drm_crtc_vblank_off(&disp->crtc);
+ spin_lock_irq(&crtc->dev->event_lock);
+ if (crtc->state->event) {
+ drm_crtc_send_vblank_event(crtc, crtc->state->event);
+ crtc->state->event = NULL;
+ }
+ spin_unlock_irq(&crtc->dev->event_lock);
+
clk_disable_unprepare(disp->pclk);
pm_runtime_put_sync(disp->dev);
}
--
2.27.0
next prev parent reply other threads:[~2021-02-25 10:16 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-25 9:53 [PATCH 5.10 00/23] 5.10.19-rc1 review Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 01/23] bpf: Fix truncation handling for mod32 dst reg wrt zero Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 02/23] HID: make arrays usage and value to be the same Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 03/23] RDMA: Lift ibdev_to_node from rds to common code Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 04/23] nvme-rdma: Use ibdev_to_node instead of dereferencing ->dma_device Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 05/23] USB: quirks: sort quirk entries Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 06/23] usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 07/23] ceph: downgrade warning from mdsmap decode to debug Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 08/23] ntfs: check for valid standard information attribute Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 09/23] Bluetooth: btusb: Some Qualcomm Bluetooth adapters stop working Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 10/23] arm64: tegra: Add power-domain for Tegra210 HDA Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 11/23] hwmon: (dell-smm) Add XPS 15 L502X to fan control blacklist Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 12/23] KVM: x86: Zap the oldest MMU pages, not the newest Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 13/23] mm: unexport follow_pte_pmd Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 14/23] mm: simplify follow_pte{,pmd} Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 15/23] KVM: do not assume PTE is writable after follow_pfn Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 16/23] mm: provide a saner PTE walking API for modules Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 17/23] KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped() Greg Kroah-Hartman
2021-02-25 9:53 ` Greg Kroah-Hartman [this message]
2021-02-25 9:53 ` [PATCH 5.10 19/23] NET: usb: qmi_wwan: Adding support for Cinterion MV31 Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 20/23] cxgb4: Add new T6 PCI device id 0x6092 Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 21/23] cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 22/23] kbuild: fix CONFIG_TRIM_UNUSED_KSYMS build for ppc64 Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 23/23] scripts/recordmcount.pl: support big endian for ARCH sh Greg Kroah-Hartman
2021-02-25 19:52 ` [PATCH 5.10 00/23] 5.10.19-rc1 review Guenter Roeck
2021-02-25 19:54 ` Pavel Machek
2021-02-25 21:35 ` Florian Fainelli
2021-02-26 2:24 ` Shuah Khan
2021-02-26 3:41 ` Ross Schmidt
2021-02-26 6:44 ` Hanjun Guo
2021-02-27 1:47 ` Hanjun Guo
2021-02-26 6:57 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210225092517.401977784@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=daniel.vetter@ffwll.ch \
--cc=linux-kernel@vger.kernel.org \
--cc=quanyang.wang@windriver.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).