drm/atomic: Handle -EDEADLK with out-fences correctly

Commit Message

Maarten Lankhorst Aug. 14, 2017, 10:07 a.m. UTC

complete_crtc_signaling is freeing fence_state, but when retrying
num_fences and fence_state are not zero'd. This caused duplicate
fd's in the fence_state array, followed by a BUG_ON in fs/file.c
because we reallocate freed memory, and installing over an existing
fd, or potential other fun.

Zero fence_state and num_fences correctly in the retry loop, which
allows kms_atomic_transition to pass.

Fixes: beaf5af48034 ("drm/fence: add out-fences support")
Cc: Gustavo Padovan <[e-mail]>
Cc: Brian Starkey <[e-mail]> (v10)
Cc: Sean Paul <[e-mail]>
Cc: Daniel Vetter <[e-mail]>
Cc: Jani Nikula <[e-mail]>
Cc: David Airlie <[e-mail]>
Signed-off-by: Maarten Lankhorst <[e-mail]>
Cc: <[e-mail]> # v4.10+
Testcase: kms_atomic_transitions.plane-all-modeset-transition-fencing
(with CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y)
---
 drivers/gpu/drm/drm_atomic.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Comments

Gustavo Padovan Aug. 18, 2017, 4:59 p.m. UTC | #1

2017-08-14 Maarten Lankhorst <[e-mail]>:

> complete_crtc_signaling is freeing fence_state, but when retrying
> num_fences and fence_state are not zero'd. This caused duplicate
> fd's in the fence_state array, followed by a BUG_ON in fs/file.c
> because we reallocate freed memory, and installing over an existing
> fd, or potential other fun.
> 
> Zero fence_state and num_fences correctly in the retry loop, which
> allows kms_atomic_transition to pass.
> 
> Fixes: beaf5af48034 ("drm/fence: add out-fences support")
> Cc: Gustavo Padovan <[e-mail]>
> Cc: Brian Starkey <[e-mail]> (v10)
> Cc: Sean Paul <[e-mail]>
> Cc: Daniel Vetter <[e-mail]>
> Cc: Jani Nikula <[e-mail]>
> Cc: David Airlie <[e-mail]>
> Signed-off-by: Maarten Lankhorst <[e-mail]>
> Cc: <[e-mail]> # v4.10+
> Testcase: kms_atomic_transitions.plane-all-modeset-transition-fencing
> (with CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y)
> ---
>  drivers/gpu/drm/drm_atomic.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)

Reviewed-by: Gustavo Padovan <[e-mail]>

	Gustavo

Daniel Vetter Aug. 18, 2017, 8:13 p.m. UTC | #2

On Fri, Aug 18, 2017 at 01:59:10PM -0300, Gustavo Padovan wrote:
> 2017-08-14 Maarten Lankhorst <[e-mail]>:
> 
> > complete_crtc_signaling is freeing fence_state, but when retrying
> > num_fences and fence_state are not zero'd. This caused duplicate
> > fd's in the fence_state array, followed by a BUG_ON in fs/file.c
> > because we reallocate freed memory, and installing over an existing
> > fd, or potential other fun.
> > 
> > Zero fence_state and num_fences correctly in the retry loop, which
> > allows kms_atomic_transition to pass.
> > 
> > Fixes: beaf5af48034 ("drm/fence: add out-fences support")
> > Cc: Gustavo Padovan <[e-mail]>
> > Cc: Brian Starkey <[e-mail]> (v10)
> > Cc: Sean Paul <[e-mail]>
> > Cc: Daniel Vetter <[e-mail]>
> > Cc: Jani Nikula <[e-mail]>
> > Cc: David Airlie <[e-mail]>
> > Signed-off-by: Maarten Lankhorst <[e-mail]>
> > Cc: <[e-mail]> # v4.10+
> > Testcase: kms_atomic_transitions.plane-all-modeset-transition-fencing
> > (with CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y)
> > ---
> >  drivers/gpu/drm/drm_atomic.c | 6 ++++--
> >  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> Reviewed-by: Gustavo Padovan <[e-mail]>

Hm somehow this fell through, applied to drm-misc-fixes.
-Daniel

Daniel Vetter Aug. 18, 2017, 8:14 p.m. UTC | #3

On Fri, Aug 18, 2017 at 10:13:08PM +0200, Daniel Vetter wrote:
> On Fri, Aug 18, 2017 at 01:59:10PM -0300, Gustavo Padovan wrote:
> > 2017-08-14 Maarten Lankhorst <[e-mail]>:
> > 
> > > complete_crtc_signaling is freeing fence_state, but when retrying
> > > num_fences and fence_state are not zero'd. This caused duplicate
> > > fd's in the fence_state array, followed by a BUG_ON in fs/file.c
> > > because we reallocate freed memory, and installing over an existing
> > > fd, or potential other fun.
> > > 
> > > Zero fence_state and num_fences correctly in the retry loop, which
> > > allows kms_atomic_transition to pass.
> > > 
> > > Fixes: beaf5af48034 ("drm/fence: add out-fences support")
> > > Cc: Gustavo Padovan <[e-mail]>
> > > Cc: Brian Starkey <[e-mail]> (v10)
> > > Cc: Sean Paul <[e-mail]>
> > > Cc: Daniel Vetter <[e-mail]>
> > > Cc: Jani Nikula <[e-mail]>
> > > Cc: David Airlie <[e-mail]>
> > > Signed-off-by: Maarten Lankhorst <[e-mail]>
> > > Cc: <[e-mail]> # v4.10+
> > > Testcase: kms_atomic_transitions.plane-all-modeset-transition-fencing
> > > (with CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y)
> > > ---
> > >  drivers/gpu/drm/drm_atomic.c | 6 ++++--
> > >  1 file changed, 4 insertions(+), 2 deletions(-)
> > 
> > Reviewed-by: Gustavo Padovan <[e-mail]>
> 
> Hm somehow this fell through, applied to drm-misc-fixes.

Actually it was merged already, I was on an old -fixes.
-Daniel

Patch

diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 1b755439f591..8ec9be4f5d50 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -2203,10 +2203,10 @@  int drm_mode_atomic_ioctl(struct drm_device *dev,
 	struct drm_atomic_state *state;
 	struct drm_modeset_acquire_ctx ctx;
 	struct drm_plane *plane;
-	struct drm_out_fence_state *fence_state = NULL;
+	struct drm_out_fence_state *fence_state;
 	unsigned plane_mask;
 	int ret = 0;
-	unsigned int i, j, num_fences = 0;
+	unsigned int i, j, num_fences;
 
 	/* disallow for drivers not supporting atomic: */
 	if (!drm_core_check_feature(dev, DRIVER_ATOMIC))
@@ -2247,6 +2247,8 @@  int drm_mode_atomic_ioctl(struct drm_device *dev,
 	plane_mask = 0;
 	copied_objs = 0;
 	copied_props = 0;
+	fence_state = NULL;
+	num_fences = 0;
 
 	for (i = 0; i < arg->count_objs; i++) {
 		uint32_t obj_id, count_props;