[Intel-gfx] drm/i915/display: cleanup intel_bw_state on i915 module removal
diff mbox series

Message ID 20191209143921.9240-1-pankaj.laxminarayan.bharadiya@intel.com
State New
Headers show
Series
  • [Intel-gfx] drm/i915/display: cleanup intel_bw_state on i915 module removal
Related show

Commit Message

Pankaj Bharadiya Dec. 9, 2019, 2:39 p.m. UTC
intel_bw_state allocated memory is not getting freed even after
module removal.

kmemleak reported backtrace:

    [<0000000079019739>] kmemdup+0x17/0x40
    [<00000000d58c1b9d>] intel_bw_duplicate_state+0x1b/0x40 [i915]
    [<000000007423ed0c>] drm_atomic_get_private_obj_state+0xca/0x140
    [<00000000100e3533>] intel_bw_atomic_check+0x133/0x350 [i915]
    [<00000000126d0e0c>] intel_atomic_check+0x1ab7/0x20d0 [i915]
    [<00000000d5dfc004>] drm_atomic_check_only+0x563/0x810
    [<00000000c9379611>] drm_atomic_commit+0xe/0x50
    [<00000000ec82b765>] drm_atomic_helper_disable_all+0x133/0x160
    [<000000003c44760c>] drm_atomic_helper_shutdown+0x65/0xc0
    [<00000000414e3e5c>] i915_driver_remove+0xcb/0x130 [i915]
    [<00000000f8544c2a>] i915_pci_remove+0x19/0x40 [i915]
    [<000000002dcbd148>] pci_device_remove+0x36/0xb0
    [<000000003c8c6b0a>] device_release_driver_internal+0xe0/0x1c0
    [<00000000580e9566>] unbind_store+0xc3/0x120
    [<00000000869d0df5>] kernfs_fop_write+0x104/0x190
    [<000000004dc1a355>] vfs_write+0xb9/0x1d0

Call the drm_atomic_private_obj_fini(), which inturn calls the
intel_bw_destroy_state() to make sure the intel_bw_state memory is
freed properly.

Signed-off-by: Pankaj Bharadiya <pankaj.laxminarayan.bharadiya@intel.com>
---
 drivers/gpu/drm/i915/display/intel_bw.c      | 5 +++++
 drivers/gpu/drm/i915/display/intel_bw.h      | 1 +
 drivers/gpu/drm/i915/display/intel_display.c | 2 ++
 3 files changed, 8 insertions(+)

Comments

Lucas De Marchi Dec. 11, 2019, 5:57 a.m. UTC | #1
On Mon, Dec 09, 2019 at 08:09:02PM +0530, Pankaj Bharadiya wrote:
>intel_bw_state allocated memory is not getting freed even after
>module removal.
>
>kmemleak reported backtrace:
>
>    [<0000000079019739>] kmemdup+0x17/0x40
>    [<00000000d58c1b9d>] intel_bw_duplicate_state+0x1b/0x40 [i915]
>    [<000000007423ed0c>] drm_atomic_get_private_obj_state+0xca/0x140
>    [<00000000100e3533>] intel_bw_atomic_check+0x133/0x350 [i915]
>    [<00000000126d0e0c>] intel_atomic_check+0x1ab7/0x20d0 [i915]
>    [<00000000d5dfc004>] drm_atomic_check_only+0x563/0x810
>    [<00000000c9379611>] drm_atomic_commit+0xe/0x50
>    [<00000000ec82b765>] drm_atomic_helper_disable_all+0x133/0x160
>    [<000000003c44760c>] drm_atomic_helper_shutdown+0x65/0xc0
>    [<00000000414e3e5c>] i915_driver_remove+0xcb/0x130 [i915]
>    [<00000000f8544c2a>] i915_pci_remove+0x19/0x40 [i915]
>    [<000000002dcbd148>] pci_device_remove+0x36/0xb0
>    [<000000003c8c6b0a>] device_release_driver_internal+0xe0/0x1c0
>    [<00000000580e9566>] unbind_store+0xc3/0x120
>    [<00000000869d0df5>] kernfs_fop_write+0x104/0x190
>    [<000000004dc1a355>] vfs_write+0xb9/0x1d0

what I find strange in this is that the last state was allocated by the
"driver remove" code path.

>
>Call the drm_atomic_private_obj_fini(), which inturn calls the
>intel_bw_destroy_state() to make sure the intel_bw_state memory is
>freed properly.
>
>Signed-off-by: Pankaj Bharadiya <pankaj.laxminarayan.bharadiya@intel.com>
>---
> drivers/gpu/drm/i915/display/intel_bw.c      | 5 +++++
> drivers/gpu/drm/i915/display/intel_bw.h      | 1 +
> drivers/gpu/drm/i915/display/intel_display.c | 2 ++
> 3 files changed, 8 insertions(+)
>
>diff --git a/drivers/gpu/drm/i915/display/intel_bw.c b/drivers/gpu/drm/i915/display/intel_bw.c
>index dcb66a33be9b..b228671d5a5d 100644
>--- a/drivers/gpu/drm/i915/display/intel_bw.c
>+++ b/drivers/gpu/drm/i915/display/intel_bw.c
>@@ -486,3 +486,8 @@ int intel_bw_init(struct drm_i915_private *dev_priv)
>
> 	return 0;
> }
>+
>+void intel_bw_cleanup(struct drm_i915_private *dev_priv)
>+{
>+	drm_atomic_private_obj_fini(&dev_priv->bw_obj);
>+}
>diff --git a/drivers/gpu/drm/i915/display/intel_bw.h b/drivers/gpu/drm/i915/display/intel_bw.h
>index 9db10af012f4..20b9ad241802 100644
>--- a/drivers/gpu/drm/i915/display/intel_bw.h
>+++ b/drivers/gpu/drm/i915/display/intel_bw.h
>@@ -25,6 +25,7 @@ struct intel_bw_state {
>
> void intel_bw_init_hw(struct drm_i915_private *dev_priv);
> int intel_bw_init(struct drm_i915_private *dev_priv);
>+void intel_bw_cleanup(struct drm_i915_private *dev_priv);
> int intel_bw_atomic_check(struct intel_atomic_state *state);
> void intel_bw_crtc_update(struct intel_bw_state *bw_state,
> 			  const struct intel_crtc_state *crtc_state);
>diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
>index 3190aa27ffdc..756eb90b1bb1 100644
>--- a/drivers/gpu/drm/i915/display/intel_display.c
>+++ b/drivers/gpu/drm/i915/display/intel_display.c
>@@ -17912,6 +17912,8 @@ void intel_modeset_driver_remove(struct drm_i915_private *i915)
>
> 	intel_gmbus_teardown(i915);
>
>+	intel_bw_cleanup(i915);

This doesn't seem to match the (reverse) order of
intel_modeset_init()... but it's actually the gmbus_teardown() that is
out of place. Did you check if it's not a wrong shutdown ordering?

thanks
Lucas De Marchi

>+
> 	destroy_workqueue(i915->flip_wq);
> 	destroy_workqueue(i915->modeset_wq);
>
>-- 
>2.23.0
>
>_______________________________________________
>Intel-gfx mailing list
>Intel-gfx@lists.freedesktop.org
>https://lists.freedesktop.org/mailman/listinfo/intel-gfx
Pankaj Bharadiya Dec. 11, 2019, 6:40 a.m. UTC | #2
On Tue, Dec 10, 2019 at 09:57:39PM -0800, Lucas De Marchi wrote:
> On Mon, Dec 09, 2019 at 08:09:02PM +0530, Pankaj Bharadiya wrote:
> >intel_bw_state allocated memory is not getting freed even after
> >module removal.
> >
> >kmemleak reported backtrace:
> >
> >   [<0000000079019739>] kmemdup+0x17/0x40
> >   [<00000000d58c1b9d>] intel_bw_duplicate_state+0x1b/0x40 [i915]
> >   [<000000007423ed0c>] drm_atomic_get_private_obj_state+0xca/0x140
> >   [<00000000100e3533>] intel_bw_atomic_check+0x133/0x350 [i915]
> >   [<00000000126d0e0c>] intel_atomic_check+0x1ab7/0x20d0 [i915]
> >   [<00000000d5dfc004>] drm_atomic_check_only+0x563/0x810
> >   [<00000000c9379611>] drm_atomic_commit+0xe/0x50
> >   [<00000000ec82b765>] drm_atomic_helper_disable_all+0x133/0x160
> >   [<000000003c44760c>] drm_atomic_helper_shutdown+0x65/0xc0
> >   [<00000000414e3e5c>] i915_driver_remove+0xcb/0x130 [i915]
> >   [<00000000f8544c2a>] i915_pci_remove+0x19/0x40 [i915]
> >   [<000000002dcbd148>] pci_device_remove+0x36/0xb0
> >   [<000000003c8c6b0a>] device_release_driver_internal+0xe0/0x1c0
> >   [<00000000580e9566>] unbind_store+0xc3/0x120
> >   [<00000000869d0df5>] kernfs_fop_write+0x104/0x190
> >   [<000000004dc1a355>] vfs_write+0xb9/0x1d0
> 
> what I find strange in this is that the last state was allocated by the
> "driver remove" code path.
> 
> >
> >Call the drm_atomic_private_obj_fini(), which inturn calls the
> >intel_bw_destroy_state() to make sure the intel_bw_state memory is
> >freed properly.
> >
> >Signed-off-by: Pankaj Bharadiya <pankaj.laxminarayan.bharadiya@intel.com>
> >---
> >drivers/gpu/drm/i915/display/intel_bw.c      | 5 +++++
> >drivers/gpu/drm/i915/display/intel_bw.h      | 1 +
> >drivers/gpu/drm/i915/display/intel_display.c | 2 ++
> >3 files changed, 8 insertions(+)
> >
> >diff --git a/drivers/gpu/drm/i915/display/intel_bw.c b/drivers/gpu/drm/i915/display/intel_bw.c
> >index dcb66a33be9b..b228671d5a5d 100644
> >--- a/drivers/gpu/drm/i915/display/intel_bw.c
> >+++ b/drivers/gpu/drm/i915/display/intel_bw.c
> >@@ -486,3 +486,8 @@ int intel_bw_init(struct drm_i915_private *dev_priv)
> >
> >	return 0;
> >}
> >+
> >+void intel_bw_cleanup(struct drm_i915_private *dev_priv)
> >+{
> >+	drm_atomic_private_obj_fini(&dev_priv->bw_obj);
> >+}
> >diff --git a/drivers/gpu/drm/i915/display/intel_bw.h b/drivers/gpu/drm/i915/display/intel_bw.h
> >index 9db10af012f4..20b9ad241802 100644
> >--- a/drivers/gpu/drm/i915/display/intel_bw.h
> >+++ b/drivers/gpu/drm/i915/display/intel_bw.h
> >@@ -25,6 +25,7 @@ struct intel_bw_state {
> >
> >void intel_bw_init_hw(struct drm_i915_private *dev_priv);
> >int intel_bw_init(struct drm_i915_private *dev_priv);
> >+void intel_bw_cleanup(struct drm_i915_private *dev_priv);
> >int intel_bw_atomic_check(struct intel_atomic_state *state);
> >void intel_bw_crtc_update(struct intel_bw_state *bw_state,
> >			  const struct intel_crtc_state *crtc_state);
> >diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
> >index 3190aa27ffdc..756eb90b1bb1 100644
> >--- a/drivers/gpu/drm/i915/display/intel_display.c
> >+++ b/drivers/gpu/drm/i915/display/intel_display.c
> >@@ -17912,6 +17912,8 @@ void intel_modeset_driver_remove(struct drm_i915_private *i915)
> >
> >	intel_gmbus_teardown(i915);
> >
> >+	intel_bw_cleanup(i915);
> 
> This doesn't seem to match the (reverse) order of
> intel_modeset_init()... but it's actually the gmbus_teardown() that is
> out of place. Did you check if it's not a wrong shutdown ordering?
>

In intel_modeset_init(), intel_gmbus_setup() happens after
intel_bw_init().
I think the patch follows the reverse ordering properly.
Am I missing anything?

Thanks,
Pankaj

> thanks
> Lucas De Marchi
> 
> >+
> >	destroy_workqueue(i915->flip_wq);
> >	destroy_workqueue(i915->modeset_wq);
> >
> >-- 
> >2.23.0
> >
> >_______________________________________________
> >Intel-gfx mailing list
> >Intel-gfx@lists.freedesktop.org
> >https://lists.freedesktop.org/mailman/listinfo/intel-gfx
Pankaj Bharadiya Dec. 12, 2019, 10:28 a.m. UTC | #3
On Wed, Dec 11, 2019 at 04:22:50PM -0800, Lucas De Marchi wrote:
> On Wed, Dec 11, 2019 at 12:10:41PM +0530, Bharadiya,Pankaj wrote:
> >On Tue, Dec 10, 2019 at 09:57:39PM -0800, Lucas De Marchi wrote:
> >>On Mon, Dec 09, 2019 at 08:09:02PM +0530, Pankaj Bharadiya wrote:
> >>>intel_bw_state allocated memory is not getting freed even after
> >>>module removal.
> >>>
> >>>kmemleak reported backtrace:
> >>>
> >>>   [<0000000079019739>] kmemdup+0x17/0x40
> >>>   [<00000000d58c1b9d>] intel_bw_duplicate_state+0x1b/0x40 [i915]
> >>>   [<000000007423ed0c>] drm_atomic_get_private_obj_state+0xca/0x140
> >>>   [<00000000100e3533>] intel_bw_atomic_check+0x133/0x350 [i915]
> >>>   [<00000000126d0e0c>] intel_atomic_check+0x1ab7/0x20d0 [i915]
> >>>   [<00000000d5dfc004>] drm_atomic_check_only+0x563/0x810
> >>>   [<00000000c9379611>] drm_atomic_commit+0xe/0x50
> >>>   [<00000000ec82b765>] drm_atomic_helper_disable_all+0x133/0x160
> >>>   [<000000003c44760c>] drm_atomic_helper_shutdown+0x65/0xc0
> >>>   [<00000000414e3e5c>] i915_driver_remove+0xcb/0x130 [i915]
> >>>   [<00000000f8544c2a>] i915_pci_remove+0x19/0x40 [i915]
> >>>   [<000000002dcbd148>] pci_device_remove+0x36/0xb0
> >>>   [<000000003c8c6b0a>] device_release_driver_internal+0xe0/0x1c0
> >>>   [<00000000580e9566>] unbind_store+0xc3/0x120
> >>>   [<00000000869d0df5>] kernfs_fop_write+0x104/0x190
> >>>   [<000000004dc1a355>] vfs_write+0xb9/0x1d0
> >>
> >>what I find strange in this is that the last state was allocated by the
> >>"driver remove" code path.
> >>
> >>>
> >>>Call the drm_atomic_private_obj_fini(), which inturn calls the
> >>>intel_bw_destroy_state() to make sure the intel_bw_state memory is
> >>>freed properly.
> >>>
> >>>Signed-off-by: Pankaj Bharadiya <pankaj.laxminarayan.bharadiya@intel.com>
> >>>---
> >>>drivers/gpu/drm/i915/display/intel_bw.c      | 5 +++++
> >>>drivers/gpu/drm/i915/display/intel_bw.h      | 1 +
> >>>drivers/gpu/drm/i915/display/intel_display.c | 2 ++
> >>>3 files changed, 8 insertions(+)
> >>>
> >>>diff --git a/drivers/gpu/drm/i915/display/intel_bw.c b/drivers/gpu/drm/i915/display/intel_bw.c
> >>>index dcb66a33be9b..b228671d5a5d 100644
> >>>--- a/drivers/gpu/drm/i915/display/intel_bw.c
> >>>+++ b/drivers/gpu/drm/i915/display/intel_bw.c
> >>>@@ -486,3 +486,8 @@ int intel_bw_init(struct drm_i915_private *dev_priv)
> >>>
n
> >>>	return 0;
> >>>}
> >>>+
> >>>+void intel_bw_cleanup(struct drm_i915_private *dev_priv)
> >>>+{
> >>>+	drm_atomic_private_obj_fini(&dev_priv->bw_obj);
> >>>+}
> >>>diff --git a/drivers/gpu/drm/i915/display/intel_bw.h b/drivers/gpu/drm/i915/display/intel_bw.h
> >>>index 9db10af012f4..20b9ad241802 100644
> >>>--- a/drivers/gpu/drm/i915/display/intel_bw.h
> >>>+++ b/drivers/gpu/drm/i915/display/intel_bw.h
> >>>@@ -25,6 +25,7 @@ struct intel_bw_state {
> >>>
> >>>void intel_bw_init_hw(struct drm_i915_private *dev_priv);
> >>>int intel_bw_init(struct drm_i915_private *dev_priv);
> >>>+void intel_bw_cleanup(struct drm_i915_private *dev_priv);
> >>>int intel_bw_atomic_check(struct intel_atomic_state *state);
> >>>void intel_bw_crtc_update(struct intel_bw_state *bw_state,
> >>>			  const struct intel_crtc_state *crtc_state);
> >>>diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
> >>>index 3190aa27ffdc..756eb90b1bb1 100644
> >>>--- a/drivers/gpu/drm/i915/display/intel_display.c
> >>>+++ b/drivers/gpu/drm/i915/display/intel_display.c
> >>>@@ -17912,6 +17912,8 @@ void intel_modeset_driver_remove(struct drm_i915_private *i915)
> >>>
> >>>	intel_gmbus_teardown(i915);
> >>>
> >>>+	intel_bw_cleanup(i915);
> >>
> >>This doesn't seem to match the (reverse) order of
> >>intel_modeset_init()... but it's actually the gmbus_teardown() that is
> >>out of place. Did you check if it's not a wrong shutdown ordering?
> >>
> >
> >In intel_modeset_init(), intel_gmbus_setup() happens after
> >intel_bw_init().
> >I think the patch follows the reverse ordering properly.
> >Am I missing anything?
> 
> I said it seems that it's the gmbus_teardown() that is out of place.

Hummm. 

> Have you seen my comment above? Why are we duplicating the bw_state on
> the module-remove code path?

I am not exactly sure why duplicating of bw_state happens on removal.

Despite of this, I think we need to have a method to clean up
the resources allocated/initialized using drm_atotomic_private_obj_init()
from intel_bw_init() which is missing at the moment.

Moreover, I am getting below kmemleak trace on my NUC during module
load/unload sequence. 

 backtrace:
    [<00000000fe2b0db8>] intel_bw_init+0x1a/0x50 [i915]
    [<00000000ae7de386>] intel_modeset_init+0x197/0x1d60 [i915]
    [<00000000b520b2d8>] i915_driver_probe+0xae6/0x1520 [i915]
    [<00000000682b3100>] i915_pci_probe+0x3f/0x150 [i915]
    [<00000000efd970df>] local_pci_probe+0x3d/0x90
    [<00000000a05c08fe>] pci_device_probe+0xd5/0x160
    [<000000004fdf5c22>] really_probe+0x1b1/0x300
    [<0000000006397c43>] driver_probe_device+0x4b/0xe0
    [<000000008ac9d085>] device_driver_attach+0x4a/0x50
    [<000000004c50b157>] __driver_attach+0x67/0xb0
    [<000000007e27c7f9>] bus_for_each_dev+0x71/0xb0
    [<0000000042286228>] bus_add_driver+0x177/0x1f0
    [<000000006b066a1f>] driver_register+0x56/0xf0
    [<0000000023883b3a>] do_one_initcall+0x41/0x1df
    [<00000000933062b0>] do_init_module+0x56/0x1f8
    [<00000000dde25517>] load_module+0x201c/0x2700

Freeing up the resources during module unload sequence with
drm_atomic_private_obj_fini() fixes this.

Thanks,
Pankaj

> 
> Lucas De Marchi
> 
> >
> >Thanks,
> >Pankaj
> >
> >>thanks
> >>Lucas De Marchi
> >>
> >>>+
> >>>	destroy_workqueue(i915->flip_wq);
> >>>	destroy_workqueue(i915->modeset_wq);
> >>>
> >>>--
> >>>2.23.0
> >>>
> >>>_______________________________________________
> >>>Intel-gfx mailing list
> >>>Intel-gfx@lists.freedesktop.org
> >>>https://lists.freedesktop.org/mailman/listinfo/intel-gfx
Matt Roper Dec. 12, 2019, 5:37 p.m. UTC | #4
On Wed, Dec 11, 2019 at 04:22:50PM -0800, Lucas De Marchi wrote:
> On Wed, Dec 11, 2019 at 12:10:41PM +0530, Bharadiya,Pankaj wrote:
> > On Tue, Dec 10, 2019 at 09:57:39PM -0800, Lucas De Marchi wrote:
> > > On Mon, Dec 09, 2019 at 08:09:02PM +0530, Pankaj Bharadiya wrote:
> > > >intel_bw_state allocated memory is not getting freed even after
> > > >module removal.
> > > >
> > > >kmemleak reported backtrace:
> > > >
> > > >   [<0000000079019739>] kmemdup+0x17/0x40
> > > >   [<00000000d58c1b9d>] intel_bw_duplicate_state+0x1b/0x40 [i915]
> > > >   [<000000007423ed0c>] drm_atomic_get_private_obj_state+0xca/0x140
> > > >   [<00000000100e3533>] intel_bw_atomic_check+0x133/0x350 [i915]
> > > >   [<00000000126d0e0c>] intel_atomic_check+0x1ab7/0x20d0 [i915]
> > > >   [<00000000d5dfc004>] drm_atomic_check_only+0x563/0x810
> > > >   [<00000000c9379611>] drm_atomic_commit+0xe/0x50
> > > >   [<00000000ec82b765>] drm_atomic_helper_disable_all+0x133/0x160
> > > >   [<000000003c44760c>] drm_atomic_helper_shutdown+0x65/0xc0
> > > >   [<00000000414e3e5c>] i915_driver_remove+0xcb/0x130 [i915]
> > > >   [<00000000f8544c2a>] i915_pci_remove+0x19/0x40 [i915]
> > > >   [<000000002dcbd148>] pci_device_remove+0x36/0xb0
> > > >   [<000000003c8c6b0a>] device_release_driver_internal+0xe0/0x1c0
> > > >   [<00000000580e9566>] unbind_store+0xc3/0x120
> > > >   [<00000000869d0df5>] kernfs_fop_write+0x104/0x190
> > > >   [<000000004dc1a355>] vfs_write+0xb9/0x1d0
> > > 
> > > what I find strange in this is that the last state was allocated by the
> > > "driver remove" code path.
> > > 
> > > >
> > > >Call the drm_atomic_private_obj_fini(), which inturn calls the
> > > >intel_bw_destroy_state() to make sure the intel_bw_state memory is
> > > >freed properly.
> > > >
> > > >Signed-off-by: Pankaj Bharadiya <pankaj.laxminarayan.bharadiya@intel.com>
> > > >---
> > > >drivers/gpu/drm/i915/display/intel_bw.c      | 5 +++++
> > > >drivers/gpu/drm/i915/display/intel_bw.h      | 1 +
> > > >drivers/gpu/drm/i915/display/intel_display.c | 2 ++
> > > >3 files changed, 8 insertions(+)
> > > >
> > > >diff --git a/drivers/gpu/drm/i915/display/intel_bw.c b/drivers/gpu/drm/i915/display/intel_bw.c
> > > >index dcb66a33be9b..b228671d5a5d 100644
> > > >--- a/drivers/gpu/drm/i915/display/intel_bw.c
> > > >+++ b/drivers/gpu/drm/i915/display/intel_bw.c
> > > >@@ -486,3 +486,8 @@ int intel_bw_init(struct drm_i915_private *dev_priv)
> > > >
> > > >	return 0;
> > > >}
> > > >+
> > > >+void intel_bw_cleanup(struct drm_i915_private *dev_priv)
> > > >+{
> > > >+	drm_atomic_private_obj_fini(&dev_priv->bw_obj);
> > > >+}
> > > >diff --git a/drivers/gpu/drm/i915/display/intel_bw.h b/drivers/gpu/drm/i915/display/intel_bw.h
> > > >index 9db10af012f4..20b9ad241802 100644
> > > >--- a/drivers/gpu/drm/i915/display/intel_bw.h
> > > >+++ b/drivers/gpu/drm/i915/display/intel_bw.h
> > > >@@ -25,6 +25,7 @@ struct intel_bw_state {
> > > >
> > > >void intel_bw_init_hw(struct drm_i915_private *dev_priv);
> > > >int intel_bw_init(struct drm_i915_private *dev_priv);
> > > >+void intel_bw_cleanup(struct drm_i915_private *dev_priv);
> > > >int intel_bw_atomic_check(struct intel_atomic_state *state);
> > > >void intel_bw_crtc_update(struct intel_bw_state *bw_state,
> > > >			  const struct intel_crtc_state *crtc_state);
> > > >diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
> > > >index 3190aa27ffdc..756eb90b1bb1 100644
> > > >--- a/drivers/gpu/drm/i915/display/intel_display.c
> > > >+++ b/drivers/gpu/drm/i915/display/intel_display.c
> > > >@@ -17912,6 +17912,8 @@ void intel_modeset_driver_remove(struct drm_i915_private *i915)
> > > >
> > > >	intel_gmbus_teardown(i915);
> > > >
> > > >+	intel_bw_cleanup(i915);
> > > 
> > > This doesn't seem to match the (reverse) order of
> > > intel_modeset_init()... but it's actually the gmbus_teardown() that is
> > > out of place. Did you check if it's not a wrong shutdown ordering?
> > > 
> > 
> > In intel_modeset_init(), intel_gmbus_setup() happens after
> > intel_bw_init().
> > I think the patch follows the reverse ordering properly.
> > Am I missing anything?
> 
> I said it seems that it's the gmbus_teardown() that is out of place.
> Have you seen my comment above? Why are we duplicating the bw_state on
> the module-remove code path?

I think that part is legitimate.  Part of the module remove sequence
does an atomic commit to turn everything off.  During atomic
transactions, we create duplicates of all modesetting state objects can
be modified; if/when the transaction succeeds, those duplicates are
swapped into the actual driver state and the old objects are destroyed.
Thus in cases like this where we forget to destroy a private object
state, that leaked state structure will be the one allocated during the
very last atomic transaction that happened (i.e., on the driver teardown
codepath).


Matt

> 
> Lucas De Marchi
> 
> > 
> > Thanks,
> > Pankaj
> > 
> > > thanks
> > > Lucas De Marchi
> > > 
> > > >+
> > > >	destroy_workqueue(i915->flip_wq);
> > > >	destroy_workqueue(i915->modeset_wq);
> > > >
> > > >--
> > > >2.23.0
> > > >
> > > >_______________________________________________
> > > >Intel-gfx mailing list
> > > >Intel-gfx@lists.freedesktop.org
> > > >https://lists.freedesktop.org/mailman/listinfo/intel-gfx
Matt Roper Dec. 12, 2019, 5:49 p.m. UTC | #5
On Mon, Dec 09, 2019 at 08:09:02PM +0530, Pankaj Bharadiya wrote:
> intel_bw_state allocated memory is not getting freed even after
> module removal.
> 
> kmemleak reported backtrace:
> 
>     [<0000000079019739>] kmemdup+0x17/0x40
>     [<00000000d58c1b9d>] intel_bw_duplicate_state+0x1b/0x40 [i915]
>     [<000000007423ed0c>] drm_atomic_get_private_obj_state+0xca/0x140
>     [<00000000100e3533>] intel_bw_atomic_check+0x133/0x350 [i915]
>     [<00000000126d0e0c>] intel_atomic_check+0x1ab7/0x20d0 [i915]
>     [<00000000d5dfc004>] drm_atomic_check_only+0x563/0x810
>     [<00000000c9379611>] drm_atomic_commit+0xe/0x50
>     [<00000000ec82b765>] drm_atomic_helper_disable_all+0x133/0x160
>     [<000000003c44760c>] drm_atomic_helper_shutdown+0x65/0xc0
>     [<00000000414e3e5c>] i915_driver_remove+0xcb/0x130 [i915]
>     [<00000000f8544c2a>] i915_pci_remove+0x19/0x40 [i915]
>     [<000000002dcbd148>] pci_device_remove+0x36/0xb0
>     [<000000003c8c6b0a>] device_release_driver_internal+0xe0/0x1c0
>     [<00000000580e9566>] unbind_store+0xc3/0x120
>     [<00000000869d0df5>] kernfs_fop_write+0x104/0x190
>     [<000000004dc1a355>] vfs_write+0xb9/0x1d0
> 
> Call the drm_atomic_private_obj_fini(), which inturn calls the
> intel_bw_destroy_state() to make sure the intel_bw_state memory is
> freed properly.
> 
> Signed-off-by: Pankaj Bharadiya <pankaj.laxminarayan.bharadiya@intel.com>

It looks like we'd also leak this object if intel_modeset_init() bails
out early due to failure to init a crtc.  I.e., we call
drm_mode_config_cleanup() which cleans up any regular state objects that
may have been initialized by this point, but never destroy the bw_state
which was allocated earlier in the function.


Matt

> ---
>  drivers/gpu/drm/i915/display/intel_bw.c      | 5 +++++
>  drivers/gpu/drm/i915/display/intel_bw.h      | 1 +
>  drivers/gpu/drm/i915/display/intel_display.c | 2 ++
>  3 files changed, 8 insertions(+)
> 
> diff --git a/drivers/gpu/drm/i915/display/intel_bw.c b/drivers/gpu/drm/i915/display/intel_bw.c
> index dcb66a33be9b..b228671d5a5d 100644
> --- a/drivers/gpu/drm/i915/display/intel_bw.c
> +++ b/drivers/gpu/drm/i915/display/intel_bw.c
> @@ -486,3 +486,8 @@ int intel_bw_init(struct drm_i915_private *dev_priv)
>  
>  	return 0;
>  }
> +
> +void intel_bw_cleanup(struct drm_i915_private *dev_priv)
> +{
> +	drm_atomic_private_obj_fini(&dev_priv->bw_obj);
> +}
> diff --git a/drivers/gpu/drm/i915/display/intel_bw.h b/drivers/gpu/drm/i915/display/intel_bw.h
> index 9db10af012f4..20b9ad241802 100644
> --- a/drivers/gpu/drm/i915/display/intel_bw.h
> +++ b/drivers/gpu/drm/i915/display/intel_bw.h
> @@ -25,6 +25,7 @@ struct intel_bw_state {
>  
>  void intel_bw_init_hw(struct drm_i915_private *dev_priv);
>  int intel_bw_init(struct drm_i915_private *dev_priv);
> +void intel_bw_cleanup(struct drm_i915_private *dev_priv);
>  int intel_bw_atomic_check(struct intel_atomic_state *state);
>  void intel_bw_crtc_update(struct intel_bw_state *bw_state,
>  			  const struct intel_crtc_state *crtc_state);
> diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
> index 3190aa27ffdc..756eb90b1bb1 100644
> --- a/drivers/gpu/drm/i915/display/intel_display.c
> +++ b/drivers/gpu/drm/i915/display/intel_display.c
> @@ -17912,6 +17912,8 @@ void intel_modeset_driver_remove(struct drm_i915_private *i915)
>  
>  	intel_gmbus_teardown(i915);
>  
> +	intel_bw_cleanup(i915);
> +
>  	destroy_workqueue(i915->flip_wq);
>  	destroy_workqueue(i915->modeset_wq);
>  
> -- 
> 2.23.0
>
Ville Syrjälä Dec. 12, 2019, 6:01 p.m. UTC | #6
On Thu, Dec 12, 2019 at 09:49:10AM -0800, Matt Roper wrote:
> On Mon, Dec 09, 2019 at 08:09:02PM +0530, Pankaj Bharadiya wrote:
> > intel_bw_state allocated memory is not getting freed even after
> > module removal.
> > 
> > kmemleak reported backtrace:
> > 
> >     [<0000000079019739>] kmemdup+0x17/0x40
> >     [<00000000d58c1b9d>] intel_bw_duplicate_state+0x1b/0x40 [i915]
> >     [<000000007423ed0c>] drm_atomic_get_private_obj_state+0xca/0x140
> >     [<00000000100e3533>] intel_bw_atomic_check+0x133/0x350 [i915]
> >     [<00000000126d0e0c>] intel_atomic_check+0x1ab7/0x20d0 [i915]
> >     [<00000000d5dfc004>] drm_atomic_check_only+0x563/0x810
> >     [<00000000c9379611>] drm_atomic_commit+0xe/0x50
> >     [<00000000ec82b765>] drm_atomic_helper_disable_all+0x133/0x160
> >     [<000000003c44760c>] drm_atomic_helper_shutdown+0x65/0xc0
> >     [<00000000414e3e5c>] i915_driver_remove+0xcb/0x130 [i915]
> >     [<00000000f8544c2a>] i915_pci_remove+0x19/0x40 [i915]
> >     [<000000002dcbd148>] pci_device_remove+0x36/0xb0
> >     [<000000003c8c6b0a>] device_release_driver_internal+0xe0/0x1c0
> >     [<00000000580e9566>] unbind_store+0xc3/0x120
> >     [<00000000869d0df5>] kernfs_fop_write+0x104/0x190
> >     [<000000004dc1a355>] vfs_write+0xb9/0x1d0
> > 
> > Call the drm_atomic_private_obj_fini(), which inturn calls the
> > intel_bw_destroy_state() to make sure the intel_bw_state memory is
> > freed properly.
> > 
> > Signed-off-by: Pankaj Bharadiya <pankaj.laxminarayan.bharadiya@intel.com>
> 
> It looks like we'd also leak this object if intel_modeset_init() bails
> out early due to failure to init a crtc.  I.e., we call
> drm_mode_config_cleanup() which cleans up any regular state objects that
> may have been initialized by this point, but never destroy the bw_state
> which was allocated earlier in the function.

The question is why isn't the core cleaning those up for us? It already
puts them onto a list so it could easily do it. Looks like komeda has
already hand rolled exactly that.
Shankar, Uma Dec. 24, 2019, 12:12 p.m. UTC | #7
>-----Original Message-----
>From: dri-devel <dri-devel-bounces@lists.freedesktop.org> On Behalf Of Lucas De
>Marchi
>Sent: Wednesday, December 18, 2019 1:09 AM
>To: Roper, Matthew D <matthew.d.roper@intel.com>
>Cc: Lisovskiy, Stanislav <stanislav.lisovskiy@intel.com>; David Airlie
><airlied@linux.ie>; Laxminarayan Bharadiya, Pankaj
><pankaj.laxminarayan.bharadiya@intel.com>; Summers, Stuart
><stuart.summers@intel.com>; dri-devel@lists.freedesktop.org; Vivi, Rodrigo
><rodrigo.vivi@intel.com>; intel-gfx@lists.freedesktop.org
>Subject: Re: [Intel-gfx] [PATCH] drm/i915/display: cleanup intel_bw_state on i915
>module removal
>
>On Thu, Dec 12, 2019 at 12:34:49PM -0800, Lucas De Marchi wrote:
>>On Thu, Dec 12, 2019 at 09:37:17AM -0800, Matt Roper wrote:
>>>On Wed, Dec 11, 2019 at 04:22:50PM -0800, Lucas De Marchi wrote:
>>>>On Wed, Dec 11, 2019 at 12:10:41PM +0530, Bharadiya,Pankaj wrote:
>>>>> On Tue, Dec 10, 2019 at 09:57:39PM -0800, Lucas De Marchi wrote:
>>>>> > On Mon, Dec 09, 2019 at 08:09:02PM +0530, Pankaj Bharadiya wrote:
>>>>> > >intel_bw_state allocated memory is not getting freed even after
>>>>> > >module removal.
>>>>> > >
>>>>> > >kmemleak reported backtrace:
>>>>> > >
>>>>> > >   [<0000000079019739>] kmemdup+0x17/0x40
>>>>> > >   [<00000000d58c1b9d>] intel_bw_duplicate_state+0x1b/0x40 [i915]
>>>>> > >   [<000000007423ed0c>] drm_atomic_get_private_obj_state+0xca/0x140
>>>>> > >   [<00000000100e3533>] intel_bw_atomic_check+0x133/0x350 [i915]
>>>>> > >   [<00000000126d0e0c>] intel_atomic_check+0x1ab7/0x20d0 [i915]
>>>>> > >   [<00000000d5dfc004>] drm_atomic_check_only+0x563/0x810
>>>>> > >   [<00000000c9379611>] drm_atomic_commit+0xe/0x50
>>>>> > >   [<00000000ec82b765>] drm_atomic_helper_disable_all+0x133/0x160
>>>>> > >   [<000000003c44760c>] drm_atomic_helper_shutdown+0x65/0xc0
>>>>> > >   [<00000000414e3e5c>] i915_driver_remove+0xcb/0x130 [i915]
>>>>> > >   [<00000000f8544c2a>] i915_pci_remove+0x19/0x40 [i915]
>>>>> > >   [<000000002dcbd148>] pci_device_remove+0x36/0xb0
>>>>> > >   [<000000003c8c6b0a>] device_release_driver_internal+0xe0/0x1c0
>>>>> > >   [<00000000580e9566>] unbind_store+0xc3/0x120
>>>>> > >   [<00000000869d0df5>] kernfs_fop_write+0x104/0x190
>>>>> > >   [<000000004dc1a355>] vfs_write+0xb9/0x1d0
>>>>> >
>>>>> > what I find strange in this is that the last state was allocated
>>>>> > by the "driver remove" code path.
>>>>> >
>>>>> > >
>>>>> > >Call the drm_atomic_private_obj_fini(), which inturn calls the
>>>>> > >intel_bw_destroy_state() to make sure the intel_bw_state memory
>>>>> > >is freed properly.
>>>>> > >
>>>>> > >Signed-off-by: Pankaj Bharadiya
>>>>> > ><pankaj.laxminarayan.bharadiya@intel.com>
>>>>> > >---
>>>>> > >drivers/gpu/drm/i915/display/intel_bw.c      | 5 +++++
>>>>> > >drivers/gpu/drm/i915/display/intel_bw.h      | 1 +
>>>>> > >drivers/gpu/drm/i915/display/intel_display.c | 2 ++
>>>>> > >3 files changed, 8 insertions(+)
>>>>> > >
>>>>> > >diff --git a/drivers/gpu/drm/i915/display/intel_bw.c
>>>>> > >b/drivers/gpu/drm/i915/display/intel_bw.c
>>>>> > >index dcb66a33be9b..b228671d5a5d 100644
>>>>> > >--- a/drivers/gpu/drm/i915/display/intel_bw.c
>>>>> > >+++ b/drivers/gpu/drm/i915/display/intel_bw.c
>>>>> > >@@ -486,3 +486,8 @@ int intel_bw_init(struct drm_i915_private
>>>>> > >*dev_priv)
>>>>> > >
>>>>> > >	return 0;
>>>>> > >}
>>>>> > >+
>>>>> > >+void intel_bw_cleanup(struct drm_i915_private *dev_priv) {
>>>>> > >+	drm_atomic_private_obj_fini(&dev_priv->bw_obj);
>>>>> > >+}
>>>>> > >diff --git a/drivers/gpu/drm/i915/display/intel_bw.h
>>>>> > >b/drivers/gpu/drm/i915/display/intel_bw.h
>>>>> > >index 9db10af012f4..20b9ad241802 100644
>>>>> > >--- a/drivers/gpu/drm/i915/display/intel_bw.h
>>>>> > >+++ b/drivers/gpu/drm/i915/display/intel_bw.h
>>>>> > >@@ -25,6 +25,7 @@ struct intel_bw_state {
>>>>> > >
>>>>> > >void intel_bw_init_hw(struct drm_i915_private *dev_priv); int
>>>>> > >intel_bw_init(struct drm_i915_private *dev_priv);
>>>>> > >+void intel_bw_cleanup(struct drm_i915_private *dev_priv);
>>>>> > >int intel_bw_atomic_check(struct intel_atomic_state *state);
>>>>> > >void intel_bw_crtc_update(struct intel_bw_state *bw_state,
>>>>> > >			  const struct intel_crtc_state *crtc_state); diff --git
>>>>> > >a/drivers/gpu/drm/i915/display/intel_display.c
>>>>> > >b/drivers/gpu/drm/i915/display/intel_display.c
>>>>> > >index 3190aa27ffdc..756eb90b1bb1 100644
>>>>> > >--- a/drivers/gpu/drm/i915/display/intel_display.c
>>>>> > >+++ b/drivers/gpu/drm/i915/display/intel_display.c
>>>>> > >@@ -17912,6 +17912,8 @@ void intel_modeset_driver_remove(struct
>>>>> > >drm_i915_private *i915)
>>>>> > >
>>>>> > >	intel_gmbus_teardown(i915);
>>>>> > >
>>>>> > >+	intel_bw_cleanup(i915);
>>>>> >
>>>>> > This doesn't seem to match the (reverse) order of
>>>>> > intel_modeset_init()... but it's actually the gmbus_teardown()
>>>>> > that is out of place. Did you check if it's not a wrong shutdown ordering?
>>>>> >
>>>>>
>>>>> In intel_modeset_init(), intel_gmbus_setup() happens after
>>>>> intel_bw_init().
>>>>> I think the patch follows the reverse ordering properly.
>>>>> Am I missing anything?
>>>>
>>>>I said it seems that it's the gmbus_teardown() that is out of place.
>>>>Have you seen my comment above? Why are we duplicating the bw_state
>>>>on the module-remove code path?
>>>
>>>I think that part is legitimate.  Part of the module remove sequence
>>>does an atomic commit to turn everything off.  During atomic
>>>transactions, we create duplicates of all modesetting state objects
>>>can be modified; if/when the transaction succeeds, those duplicates
>>>are swapped into the actual driver state and the old objects are destroyed.
>>>Thus in cases like this where we forget to destroy a private object
>>>state, that leaked state structure will be the one allocated during
>>>the very last atomic transaction that happened (i.e., on the driver
>>>teardown codepath).
>>
>>humn, that makes sense. The new duplicate state will replace the
>>previous one and hence why we see it in the backtrace, rather than one
>>allocated previously.
>>
>>thanks
>>Lucas De Marchi
>
>and...
>
>
>Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
>
>Lucas De Marchi

Pushed the changes to dinq. Thanks for the patch and reviews.

Regards,
Uma Shankar

>>
>>>
>>>
>>>Matt
>>>
>>>>
>>>>Lucas De Marchi
>>>>
>>>>>
>>>>> Thanks,
>>>>> Pankaj
>>>>>
>>>>> > thanks
>>>>> > Lucas De Marchi
>>>>> >
>>>>> > >+
>>>>> > >	destroy_workqueue(i915->flip_wq);
>>>>> > >	destroy_workqueue(i915->modeset_wq);
>>>>> > >
>>>>> > >--
>>>>> > >2.23.0
>>>>> > >
>>>>> > >_______________________________________________
>>>>> > >Intel-gfx mailing list
>>>>> > >Intel-gfx@lists.freedesktop.org
>>>>> > >https://lists.freedesktop.org/mailman/listinfo/intel-gfx
>>>
>>>--
>>>Matt Roper
>>>Graphics Software Engineer
>>>VTT-OSGC Platform Enablement
>>>Intel Corporation
>>>(916) 356-2795
>_______________________________________________
>dri-devel mailing list
>dri-devel@lists.freedesktop.org
>https://lists.freedesktop.org/mailman/listinfo/dri-devel

Patch
diff mbox series

diff --git a/drivers/gpu/drm/i915/display/intel_bw.c b/drivers/gpu/drm/i915/display/intel_bw.c
index dcb66a33be9b..b228671d5a5d 100644
--- a/drivers/gpu/drm/i915/display/intel_bw.c
+++ b/drivers/gpu/drm/i915/display/intel_bw.c
@@ -486,3 +486,8 @@  int intel_bw_init(struct drm_i915_private *dev_priv)
 
 	return 0;
 }
+
+void intel_bw_cleanup(struct drm_i915_private *dev_priv)
+{
+	drm_atomic_private_obj_fini(&dev_priv->bw_obj);
+}
diff --git a/drivers/gpu/drm/i915/display/intel_bw.h b/drivers/gpu/drm/i915/display/intel_bw.h
index 9db10af012f4..20b9ad241802 100644
--- a/drivers/gpu/drm/i915/display/intel_bw.h
+++ b/drivers/gpu/drm/i915/display/intel_bw.h
@@ -25,6 +25,7 @@  struct intel_bw_state {
 
 void intel_bw_init_hw(struct drm_i915_private *dev_priv);
 int intel_bw_init(struct drm_i915_private *dev_priv);
+void intel_bw_cleanup(struct drm_i915_private *dev_priv);
 int intel_bw_atomic_check(struct intel_atomic_state *state);
 void intel_bw_crtc_update(struct intel_bw_state *bw_state,
 			  const struct intel_crtc_state *crtc_state);
diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
index 3190aa27ffdc..756eb90b1bb1 100644
--- a/drivers/gpu/drm/i915/display/intel_display.c
+++ b/drivers/gpu/drm/i915/display/intel_display.c
@@ -17912,6 +17912,8 @@  void intel_modeset_driver_remove(struct drm_i915_private *i915)
 
 	intel_gmbus_teardown(i915);
 
+	intel_bw_cleanup(i915);
+
 	destroy_workqueue(i915->flip_wq);
 	destroy_workqueue(i915->modeset_wq);