From patchwork Fri Jul 14 19:14:37 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Vetter X-Patchwork-Id: 9841575 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id DFB1860212 for ; Fri, 14 Jul 2017 19:14:51 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D6C63287B0 for ; Fri, 14 Jul 2017 19:14:51 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CBED0287B7; Fri, 14 Jul 2017 19:14:51 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=unavailable version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 9A62B287B0 for ; Fri, 14 Jul 2017 19:14:51 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 179326E8C6; Fri, 14 Jul 2017 19:14:50 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-wm0-x243.google.com (mail-wm0-x243.google.com [IPv6:2a00:1450:400c:c09::243]) by gabe.freedesktop.org (Postfix) with ESMTPS id 8440C6E8BD for ; Fri, 14 Jul 2017 19:14:48 +0000 (UTC) Received: by mail-wm0-x243.google.com with SMTP id 15so519128wmm.3 for ; Fri, 14 Jul 2017 12:14:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; h=from:to:cc:subject:date:message-id; bh=JtJRgGlwU2WO78HXvUQZ9L7wDw/2g8FudsHVoiWCsC0=; b=Gf1SfmbGKUzY74ERIDowkjM3l5Ufycfax2S/kQxHThbVaoPwVteHeoa3TET8ENO87a Rvv1zc6ohYO1qIwANj+rf5rh3/pRjgbU8LUSJTQxpM9b1kqkzogfdaJjth2KkhmbBJZ3 BQDLBj+tAUs4c7KqqJitHNvdXUMOZInn1G8uA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=JtJRgGlwU2WO78HXvUQZ9L7wDw/2g8FudsHVoiWCsC0=; b=Vsbs9QgedwM+U/Eab64d27etfBCvoaM2cHpdxwID4wgECO/9mlV/3GvIU/DqeYsk3h KcdEFV4+voZUcEtwXa8M5hUy8PLKGT6rTzLzXmVDRMfRjC6zExB8fM3plHCEXHp8JaDC 4VBwsGM+U3/+ehFQdTlY/G3G0NRXY1U/xRmx79eIL2Djh8dVoxjMcMbO7Qk0m4YIW5Ek SkVeYBlidpYKkPO9R1/QT7uRh5b95WztuYniePuZCJ0rdQ0FimHg/wpZKOi7n/vSz8Z4 4HbMa/v9Dy8F5kIPrAvn971WolRlQk7a7SWVTvYS1lQ9oItmJ55+F+IVvrjvwdg3wTPW QBEw== X-Gm-Message-State: AIVw110dJllAiKYsbvCh8jcUN3IJb2ilVuFBrBZQsEbZ11uV1N7/qO/y 3PN3+aXtTo9nnfDKgAI= X-Received: by 10.80.204.214 with SMTP id b22mr7702610edj.16.1500059686855; Fri, 14 Jul 2017 12:14:46 -0700 (PDT) Received: from phenom.ffwll.local ([2a02:168:5640:0:960b:2678:e223:c1c6]) by smtp.gmail.com with ESMTPSA id x36sm4676940edb.64.2017.07.14.12.14.45 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 14 Jul 2017 12:14:46 -0700 (PDT) From: Daniel Vetter To: DRI Development Subject: [PATCH 1/3] drm/atomic-helper: Fix leak in disable_all Date: Fri, 14 Jul 2017 21:14:37 +0200 Message-Id: <20170714191439.31169-1-daniel.vetter@ffwll.ch> X-Mailer: git-send-email 2.13.2 Cc: Daniel Vetter , Daniel Vetter , Intel Graphics Development X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP The legacy plane->fb pointer is refcounted by calling drm_atomic_clean_old_fb(). In practice this isn't a real problem because: - The caller in the i915 gpu reset code restores the original state again, which means the plane->fb pointer won't change, hence can't leak. - Drivers using drm_atomic_helper_shutdown call the fbdev cleanup first, and that usually cleans up the fb through drm_remove_framebuffer, which does this correctly. - Without fbdev the only framebuffers are from userspace, and those get cleaned up (again using drm_remove_framebuffer) befor the driver can even be unloaded. But in i915 I've switched the cleanup sequence around so that the _shutdown() calls happens after the drm_remove_framebuffer(), which is how I discovered this issue. Cc: martin.peres@free.fr Cc: chris@chris-wilson.co.uk Signed-off-by: Daniel Vetter Reviewed-by: Chris Wilson --- drivers/gpu/drm/drm_atomic_helper.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index b07fc30372d3..71b5f71e61e0 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -2726,6 +2726,7 @@ int drm_atomic_helper_disable_all(struct drm_device *dev, struct drm_plane *plane; struct drm_crtc_state *crtc_state; struct drm_crtc *crtc; + unsigned plane_mask = 0; int ret, i; state = drm_atomic_state_alloc(dev); @@ -2768,10 +2769,14 @@ int drm_atomic_helper_disable_all(struct drm_device *dev, goto free; drm_atomic_set_fb_for_plane(plane_state, NULL); + plane_mask |= BIT(drm_plane_index(plane)); + plane->old_fb = plane->fb; } ret = drm_atomic_commit(state); free: + if (plane_mask) + drm_atomic_clean_old_fb(dev, plane_mask, ret); drm_atomic_state_put(state); return ret; }