From patchwork Fri Jul 14 19:14:37 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Vetter X-Patchwork-Id: 9841573 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C4C4A60212 for ; Fri, 14 Jul 2017 19:14:50 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BBA49287B7 for ; Fri, 14 Jul 2017 19:14:50 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B0688287BD; Fri, 14 Jul 2017 19:14:50 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 1AD43287B7 for ; Fri, 14 Jul 2017 19:14:50 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id B12B66E8BD; Fri, 14 Jul 2017 19:14:49 +0000 (UTC) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from mail-wm0-x241.google.com (mail-wm0-x241.google.com [IPv6:2a00:1450:400c:c09::241]) by gabe.freedesktop.org (Postfix) with ESMTPS id 2DB596E038 for ; Fri, 14 Jul 2017 19:14:48 +0000 (UTC) Received: by mail-wm0-x241.google.com with SMTP id p204so12383327wmg.1 for ; Fri, 14 Jul 2017 12:14:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; h=from:to:cc:subject:date:message-id; bh=JtJRgGlwU2WO78HXvUQZ9L7wDw/2g8FudsHVoiWCsC0=; b=Gf1SfmbGKUzY74ERIDowkjM3l5Ufycfax2S/kQxHThbVaoPwVteHeoa3TET8ENO87a Rvv1zc6ohYO1qIwANj+rf5rh3/pRjgbU8LUSJTQxpM9b1kqkzogfdaJjth2KkhmbBJZ3 BQDLBj+tAUs4c7KqqJitHNvdXUMOZInn1G8uA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=JtJRgGlwU2WO78HXvUQZ9L7wDw/2g8FudsHVoiWCsC0=; b=QVjWcWbKfYrm95MJuMIkuh9HbIsrbEZrv/s9V5GTwW4vdYrdN9yLdopcICTFrPYSEU aESMSye5/d9nqNypTTQpXdp9WC3zttYfrsy9RQS5H9XgPavCNorIw78gfvXCkqIeGyYn yMQoEjZgdGAGOt3gH2wucXhLF8waDmaMgsQ16aKGMpIU0ICfNoX7VWas5XiNIJFgHWBb zOLHg7Uc100u/pRmexVJ9L+imT3WqhX55HmtENPbI/afJoml35U8kHDwfeeu3JZ0SVJU 5hxj3qchmO34cd+e0Q2WqQa4KkAAUNDo4XCGvcc2MJ/U9Mc9JsfA5hnYpFrFocYdU6if b/dQ== X-Gm-Message-State: AIVw111rfyV+QmIVjyGmMLGtibx6g7JbVxkgQK5u19Exq03vnSSgGBOf cXZSCcb6oZLyJR1J X-Received: by 10.80.204.214 with SMTP id b22mr7702610edj.16.1500059686855; Fri, 14 Jul 2017 12:14:46 -0700 (PDT) Received: from phenom.ffwll.local ([2a02:168:5640:0:960b:2678:e223:c1c6]) by smtp.gmail.com with ESMTPSA id x36sm4676940edb.64.2017.07.14.12.14.45 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 14 Jul 2017 12:14:46 -0700 (PDT) From: Daniel Vetter To: DRI Development Date: Fri, 14 Jul 2017 21:14:37 +0200 Message-Id: <20170714191439.31169-1-daniel.vetter@ffwll.ch> X-Mailer: git-send-email 2.13.2 Cc: Daniel Vetter , Daniel Vetter , Intel Graphics Development , martin.peres@free.fr Subject: [Intel-gfx] [PATCH 1/3] drm/atomic-helper: Fix leak in disable_all X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" X-Virus-Scanned: ClamAV using ClamSMTP The legacy plane->fb pointer is refcounted by calling drm_atomic_clean_old_fb(). In practice this isn't a real problem because: - The caller in the i915 gpu reset code restores the original state again, which means the plane->fb pointer won't change, hence can't leak. - Drivers using drm_atomic_helper_shutdown call the fbdev cleanup first, and that usually cleans up the fb through drm_remove_framebuffer, which does this correctly. - Without fbdev the only framebuffers are from userspace, and those get cleaned up (again using drm_remove_framebuffer) befor the driver can even be unloaded. But in i915 I've switched the cleanup sequence around so that the _shutdown() calls happens after the drm_remove_framebuffer(), which is how I discovered this issue. Cc: martin.peres@free.fr Cc: chris@chris-wilson.co.uk Signed-off-by: Daniel Vetter Reviewed-by: Chris Wilson --- drivers/gpu/drm/drm_atomic_helper.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index b07fc30372d3..71b5f71e61e0 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -2726,6 +2726,7 @@ int drm_atomic_helper_disable_all(struct drm_device *dev, struct drm_plane *plane; struct drm_crtc_state *crtc_state; struct drm_crtc *crtc; + unsigned plane_mask = 0; int ret, i; state = drm_atomic_state_alloc(dev); @@ -2768,10 +2769,14 @@ int drm_atomic_helper_disable_all(struct drm_device *dev, goto free; drm_atomic_set_fb_for_plane(plane_state, NULL); + plane_mask |= BIT(drm_plane_index(plane)); + plane->old_fb = plane->fb; } ret = drm_atomic_commit(state); free: + if (plane_mask) + drm_atomic_clean_old_fb(dev, plane_mask, ret); drm_atomic_state_put(state); return ret; }