From patchwork Fri Nov 20 15:23:38 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matti Hamalainen X-Patchwork-Id: 11923329 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 17FC0C388F9 for ; Sat, 21 Nov 2020 11:35:00 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 9789F20B1F for ; Sat, 21 Nov 2020 11:34:59 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 9789F20B1F Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=tnsp.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id BF4746E9AB; Sat, 21 Nov 2020 11:34:33 +0000 (UTC) X-Greylist: delayed 392 seconds by postgrey-1.36 at gabe; Fri, 20 Nov 2020 15:30:29 UTC Received: from pet8032.tnsp.org (tnsp.org [IPv6:2a04:3540:1000:310:f095:b5ff:fe23:3d0e]) by gabe.freedesktop.org (Postfix) with ESMTPS id 00FA46E8C9; Fri, 20 Nov 2020 15:30:29 +0000 (UTC) Received: from nmos6502.tnsp.org (91-158-253-65.elisa-laajakaista.fi [91.158.253.65]) by pet8032.tnsp.org (Postfix) with ESMTPSA id 21D0C196A72; Fri, 20 Nov 2020 17:23:51 +0200 (EET) From: Matti Hamalainen To: linux-kernel@vger.kernel.org Subject: [PATCH] drm/nouveau: fix relocations applying logic and a double-free Date: Fri, 20 Nov 2020 17:23:38 +0200 Message-Id: <20201120152338.1203257-1-ccr@tnsp.org> X-Mailer: git-send-email 2.29.2 MIME-Version: 1.0 X-Mailman-Approved-At: Sat, 21 Nov 2020 11:34:30 +0000 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Daniel Vetter , Ben Skeggs , dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Commit 03e0d26fcf79 ("drm/nouveau: slowpath for pushbuf ioctl") included a logic-bug which results in the relocations not actually getting applied at all as the call to nouveau_gem_pushbuf_reloc_apply() is never reached. This causes a regression with graphical corruption, triggered when relocations need to be done (for example after a suspend/resume cycle.) Fix by setting *apply_relocs value only if there were more than 0 relocations. Additionally, the never reached code had a leftover u_free() call, which, after fixing the logic, now got called and resulted in a double-free. Fix by removing one u_free(), moving the other and adding check for errors. Cc: Daniel Vetter Cc: Ben Skeggs Cc: nouveau@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Matti Hamalainen Fixes: 03e0d26fcf79 ("drm/nouveau: slowpath for pushbuf ioctl") Link: https://gitlab.freedesktop.org/drm/nouveau/-/issues/11 Reviewed-by: Daniel Vetter --- drivers/gpu/drm/nouveau/nouveau_gem.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) base-commit: 3494d58865ad4a47611dbb427b214cc5227fa5eb diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c index 549bc67feabb..c2051380d18c 100644 --- a/drivers/gpu/drm/nouveau/nouveau_gem.c +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c @@ -558,8 +558,10 @@ nouveau_gem_pushbuf_validate(struct nouveau_channel *chan, NV_PRINTK(err, cli, "validating bo list\n"); validate_fini(op, chan, NULL, NULL); return ret; + } else if (ret > 0) { + *apply_relocs = true; } - *apply_relocs = ret; + return 0; } @@ -662,7 +664,6 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli, nouveau_bo_wr32(nvbo, r->reloc_bo_offset >> 2, data); } - u_free(reloc); return ret; } @@ -872,9 +873,10 @@ nouveau_gem_ioctl_pushbuf(struct drm_device *dev, void *data, break; } } - u_free(reloc); } out_prevalid: + if (!IS_ERR(reloc)) + u_free(reloc); u_free(bo); u_free(push);