| Message ID | 20240718165959.3983-2-dakr@kernel.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Nouveau fixes for TTM refcount rework | expand |
Am 18.07.24 um 18:58 schrieb Danilo Krummrich: > Calling nouveau_bo_ref() on a nouveau_bo without initializing it (and > hence the backing ttm_bo) leads to a refcount underflow. > > Instead of calling nouveau_bo_ref() in the unwind path of > drm_gem_object_init(), clean things up manually. > > Fixes: ab9ccb96a6e6 ("drm/nouveau: use prime helpers") > Signed-off-by: Danilo Krummrich <dakr@kernel.org> Thanks for looking into this, feel free to add Reviewed-by: Christian König <christian.koenig@amd.com> to this patch. But since especially patch #3 is not something I can fully judge correctness on I can only give an acked-by to the other two. Regards, Christian. > --- > drivers/gpu/drm/nouveau/nouveau_prime.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/nouveau/nouveau_prime.c b/drivers/gpu/drm/nouveau/nouveau_prime.c > index b58ab595faf8..cd95446d6851 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_prime.c > +++ b/drivers/gpu/drm/nouveau/nouveau_prime.c > @@ -64,7 +64,8 @@ struct drm_gem_object *nouveau_gem_prime_import_sg_table(struct drm_device *dev, > * to the caller, instead of a normal nouveau_bo ttm reference. */ > ret = drm_gem_object_init(dev, &nvbo->bo.base, size); > if (ret) { > - nouveau_bo_ref(NULL, &nvbo); > + drm_gem_object_release(&nvbo->bo.base); > + kfree(nvbo); > obj = ERR_PTR(-ENOMEM); > goto unlock; > }
diff --git a/drivers/gpu/drm/nouveau/nouveau_prime.c b/drivers/gpu/drm/nouveau/nouveau_prime.c index b58ab595faf8..cd95446d6851 100644 --- a/drivers/gpu/drm/nouveau/nouveau_prime.c +++ b/drivers/gpu/drm/nouveau/nouveau_prime.c @@ -64,7 +64,8 @@ struct drm_gem_object *nouveau_gem_prime_import_sg_table(struct drm_device *dev, * to the caller, instead of a normal nouveau_bo ttm reference. */ ret = drm_gem_object_init(dev, &nvbo->bo.base, size); if (ret) { - nouveau_bo_ref(NULL, &nvbo); + drm_gem_object_release(&nvbo->bo.base); + kfree(nvbo); obj = ERR_PTR(-ENOMEM); goto unlock; }
Calling nouveau_bo_ref() on a nouveau_bo without initializing it (and hence the backing ttm_bo) leads to a refcount underflow. Instead of calling nouveau_bo_ref() in the unwind path of drm_gem_object_init(), clean things up manually. Fixes: ab9ccb96a6e6 ("drm/nouveau: use prime helpers") Signed-off-by: Danilo Krummrich <dakr@kernel.org> --- drivers/gpu/drm/nouveau/nouveau_prime.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)