Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5fb06424 authored by Rob Clark's avatar Rob Clark Committed by Jordan Crouse
Browse files

drm/msm: fix leak in failed submit path 



Change-Id: Ic0dedbadf485dd63ef727402b653a9d996a13632
Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
Git-commit: 40e6815bba6e34e5560e8855b43cd3eb17b24b09
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git


[jcrouse@codeaurora.org: fix merge conflicts and initialize node at create]
Signed-off-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
parent 8416e677

drivers/gpu/drm/msm/msm_drv.h

+1 −0
Original line number Diff line number Diff line
@@ -437,6 +437,7 @@ struct msm_gem_address_space * 
msm_gem_smmu_address_space_create(struct device *dev, struct msm_mmu *mmu,

		const char *name);



void msm_gem_submit_free(struct msm_gem_submit *submit);

int msm_ioctl_gem_submit(struct drm_device *dev, void *data,

		struct drm_file *file);

drivers/gpu/drm/msm/msm_gem_submit.c

+20 −2
Original line number Diff line number Diff line
@@ -59,6 +59,11 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev, 


		submit->secure = false;



		/*

		 * Initalize node so we can safely list_del() on it if

		 * we fail in the submit path

		 */

		INIT_LIST_HEAD(&submit->node);

		INIT_LIST_HEAD(&submit->bo_list);

		ww_acquire_init(&submit->ticket, &reservation_ww_class);

	}
@@ -74,6 +79,15 @@ copy_from_user_inatomic(void *to, const void __user *from, unsigned long n) 
	return -EFAULT;

}



void msm_gem_submit_free(struct msm_gem_submit *submit)

{

	if (!submit)

		return;



	list_del(&submit->node);

	kfree(submit);

}



static int submit_lookup_objects(struct msm_gpu *gpu,

		struct msm_gem_submit *submit,

		struct drm_msm_gem_submit *args, struct drm_file *file)
@@ -381,6 +395,9 @@ static void submit_cleanup(struct msm_gpu *gpu, struct msm_gem_submit *submit, 
{

	unsigned i;



	if (!submit)

		return;



	for (i = 0; i < submit->nr_bos; i++) {

		struct msm_gem_object *msm_obj = submit->bos[i].obj;

		submit_unlock_unpin_bo(gpu, submit, i);
@@ -506,8 +523,9 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, 
	args->fence = submit->fence;



out:

	if (submit)

	submit_cleanup(gpu, submit, !!ret);

	if (ret)

		msm_gem_submit_free(submit);

	mutex_unlock(&dev->struct_mutex);

	return ret;

}

drivers/gpu/drm/msm/msm_gpu.c

+1 −2
Original line number Diff line number Diff line
@@ -479,8 +479,7 @@ static void retire_submits(struct msm_gpu *gpu, uint32_t fence) 


	list_for_each_entry_safe(submit, tmp, &gpu->submit_list, node) {

		if (COMPARE_FENCE_LTE(submit->fence, fence)) {

			list_del(&submit->node);

			kfree(submit);

			msm_gem_submit_free(submit);

		}

	}

}