Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a393c730 authored by Thomas Hellstrom's avatar Thomas Hellstrom Committed by Dave Airlie
Browse files

drm/ttm: Fix buffer object metadata accounting regression v2 



A regression was introduced in the 3.3 rc series, commit
"drm/ttm: simplify memory accounting for ttm user v2",
causing the metadata of buffer objects created using the ttm_bo_create()
function to be accounted twice.
That causes massive leaks with the vmwgfx driver running for example
SpecViewperf Catia-03 test 2, eventually killing the app.

Furthermore, the same commit introduces a regression where
metadata accounting is leaked if a buffer object is
initialized with an illegal size. This is also fixed with this commit.

v2: Fixed an error path and removed an unused variable.

Signed-off-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent fe456168

drivers/gpu/drm/ttm/ttm_bo.c

+3 −10
Original line number Diff line number Diff line
@@ -1204,6 +1204,7 @@ int ttm_bo_init(struct ttm_bo_device *bdev, 
			(*destroy)(bo);

		else

			kfree(bo);

		ttm_mem_global_free(mem_glob, acc_size);

		return -EINVAL;

	}

	bo->destroy = destroy;
@@ -1307,22 +1308,14 @@ int ttm_bo_create(struct ttm_bo_device *bdev, 
			struct ttm_buffer_object **p_bo)

{

	struct ttm_buffer_object *bo;

	struct ttm_mem_global *mem_glob = bdev->glob->mem_glob;

	size_t acc_size;

	int ret;



	acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct ttm_buffer_object));

	ret = ttm_mem_global_alloc(mem_glob, acc_size, false, false);

	if (unlikely(ret != 0))

		return ret;



	bo = kzalloc(sizeof(*bo), GFP_KERNEL);



	if (unlikely(bo == NULL)) {

		ttm_mem_global_free(mem_glob, acc_size);

	if (unlikely(bo == NULL))

		return -ENOMEM;

	}



	acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct ttm_buffer_object));

	ret = ttm_bo_init(bdev, bo, size, type, placement, page_alignment,

				buffer_start, interruptible,

			  persistent_swap_storage, acc_size, NULL, NULL);