Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-18 02:46:06 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

drm/msm: Fix hw_fence error path cleanup

Browse Source 
In an error path where the submit is free'd without the job being run,
the hw_fence pointer is simply a kzalloc'd block of memory.  In this
case we should just kfree() it, rather than trying to decrement it's
reference count.  Fortunately we can tell that this is the case by
checking for a zero refcount, since if the job was run, the submit would
be holding a reference to the hw_fence.

Fixes: f94e6a51e17c ("drm/msm: Pre-allocate hw_fence")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Patchwork: https://patchwork.freedesktop.org/patch/547088/
This commit is contained in:
Rob Clark 2023-07-12 15:25:23 -07:00
parent 6e8a996563
commit 1cd0787f08
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/gpu/drm/msm/msm_fence.c
View File

@ -191,6 +191,12 @@ msm_fence_init(struct dma_fence *fence, struct msm_fence_context *fctx)
f->fctx = fctx;
/*
* Until this point, the fence was just some pre-allocated memory,
* no-one should have taken a reference to it yet.
*/
WARN_ON(kref_read(&fence->refcount));
dma_fence_init(&f->base, &msm_fence_ops, &fctx->spinlock,
fctx->context, ++fctx->last_fence);
}

14
drivers/gpu/drm/msm/msm_gem_submit.c
View File

@ -86,7 +86,19 @@ void __msm_gem_submit_destroy(struct kref *kref)
}
dma_fence_put(submit->user_fence);
dma_fence_put(submit->hw_fence);
/*
* If the submit is freed before msm_job_run(), then hw_fence is
* just some pre-allocated memory, not a reference counted fence.
* Once the job runs and the hw_fence is initialized, it will
* have a refcount of at least one, since the submit holds a ref
* to the hw_fence.
*/
if (kref_read(&submit->hw_fence->refcount) == 0) {
kfree(submit->hw_fence);
} else {
dma_fence_put(submit->hw_fence);
}
put_pid(submit->pid);
msm_submitqueue_put(submit->queue);