From patchwork Mon May 1 18:13:27 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rob Clark X-Patchwork-Id: 13227862 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ACA1EC77B73 for ; Mon, 1 May 2023 18:13:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229861AbjEASNg (ORCPT ); Mon, 1 May 2023 14:13:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46750 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229627AbjEASNf (ORCPT ); Mon, 1 May 2023 14:13:35 -0400 Received: from mail-pl1-x62c.google.com (mail-pl1-x62c.google.com [IPv6:2607:f8b0:4864:20::62c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 175A41726; Mon, 1 May 2023 11:13:34 -0700 (PDT) Received: by mail-pl1-x62c.google.com with SMTP id d9443c01a7336-1a9253d4551so20537285ad.0; Mon, 01 May 2023 11:13:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682964813; x=1685556813; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=qEhROaQcZQLnbzTauj+cfNDcTtk+j2A/7J0LKCoVZ/4=; b=RHxFA7YqoMfiCpreigp+ya/oCYmLTGVPM9pB2mM2E8Ydm7Aua3enGM8i+/DyCmDNxC 9g9cFkDWhSBDGCT/5hCIDoo9KoN6DVlWsNWR5Gv1Yvx7HwHUauyFK1RMr5xXTaFZuF2S Z1Cyp9/2aHVOs/UFV/IiNd09RiqbQuB91Vp2Gl0W/e6q0Raxs4c0S2qRvE5Roj7siUu2 Ezic3jcx9xJD4hDxNDJThis0Z17WUAxA0jJ7KvU1d8jNPsalKhrxGaX62IxWylqf5xE+ QrxRtt+6XTPzMOFCMG3KtLeehdlC++Y31sR0zVMe676Qw6CtRjiECn6xF+BbJYXcyu9r thrg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682964813; x=1685556813; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=qEhROaQcZQLnbzTauj+cfNDcTtk+j2A/7J0LKCoVZ/4=; b=AWNgaxenUY/D0IG1n5ukSG1RuH08YG0JZOdSn8qH1h6D7mwc67jPgVS4+5Pv2aM4eV DOdCA6v1crisyS7qt8CsvUk0AJa7PWqa3DlZOS23ndhIJmFN2fhieBzMej5Diupye6pb lq+jBxN9ABHpsWMqN/dOTbDenIcuqTayj7zEAvAgn0JEDAX2cpKrGO2isuEmX5691UOW uZIcxPdgdoi//Z4w+0Qbg09CoyXk7g65TaEXnHVDI5qdojlrolq9aZkGpcq8Ux5R261z sdnglsmK/bMXohUErKdF4ygZV28sNNxZZdhUvLCm88BehOMDUHQgewsqEoo5x6RMbYQv smLw== X-Gm-Message-State: AC+VfDxXC1REWWhYXMJnH7VZT7GTa2ZKRHN19u4iOwgbCYXyxZCSM5Pv sEnxM7hfXm1zexDL+LlkORYokyVk/AA= X-Google-Smtp-Source: ACHHUZ5wIp76xl2tP0hTBbDGoPFOJBbuzJrVyCWD1JDP6rmO7Pfto8qsf0S2tL6pu8d+9WubviVRMw== X-Received: by 2002:a17:902:c94d:b0:1a6:6fe3:df9e with SMTP id i13-20020a170902c94d00b001a66fe3df9emr18756479pla.47.1682964813453; Mon, 01 May 2023 11:13:33 -0700 (PDT) Received: from localhost ([2a00:79e1:abd:4a00:61b:48ed:72ab:435b]) by smtp.gmail.com with ESMTPSA id l9-20020a170902d34900b001a1c721f7f8sm18168322plk.267.2023.05.01.11.13.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 May 2023 11:13:33 -0700 (PDT) From: Rob Clark To: dri-devel@lists.freedesktop.org Cc: freedreno@lists.freedesktop.org, linux-arm-msm@vger.kernel.org, Rob Clark , pinkperfect2021@gmail.com, Rob Clark , Abhinav Kumar , Dmitry Baryshkov , Sean Paul , David Airlie , Daniel Vetter , linux-kernel@vger.kernel.org (open list) Subject: [PATCH v2] drm/msm: Fix submit error-path leaks Date: Mon, 1 May 2023 11:13:27 -0700 Message-Id: <20230501181327.1618596-1-robdclark@gmail.com> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org From: Rob Clark For errors after msm_submitqueue_get(), we need to drop the submitqueue reference. Additionally after get_unused_fd() we need to drop the fd. The ordering for dropping the queue lock and put_unused_fd() is not important, so just move this all into out_post_unlock. v2: Only drop queue ref if submit doesn't take it Reported-by: pinkperfect2021@gmail.com Fixes: f0de40a131d9 drm/msm: ("Reorder lock vs submit alloc") Signed-off-by: Rob Clark --- drivers/gpu/drm/msm/msm_gem_submit.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c index 6c6aefaa72be..77d73a81d10e 100644 --- a/drivers/gpu/drm/msm/msm_gem_submit.c +++ b/drivers/gpu/drm/msm/msm_gem_submit.c @@ -767,27 +767,29 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, queue = msm_submitqueue_get(ctx, args->queueid); if (!queue) return -ENOENT; ring = gpu->rb[queue->ring_nr]; if (args->flags & MSM_SUBMIT_FENCE_FD_OUT) { out_fence_fd = get_unused_fd_flags(O_CLOEXEC); if (out_fence_fd < 0) { ret = out_fence_fd; - return ret; + goto out_post_unlock; } } submit = submit_create(dev, gpu, queue, args->nr_bos, args->nr_cmds); - if (IS_ERR(submit)) - return PTR_ERR(submit); + if (IS_ERR(submit)) { + ret = PTR_ERR(submit); + goto out_post_unlock; + } trace_msm_gpu_submit(pid_nr(submit->pid), ring->id, submit->ident, args->nr_bos, args->nr_cmds); ret = mutex_lock_interruptible(&queue->lock); if (ret) goto out_post_unlock; if (args->flags & MSM_SUBMIT_SUDO) submit->in_rb = true; @@ -962,25 +964,33 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, msm_reset_syncobjs(syncobjs_to_reset, args->nr_in_syncobjs); msm_process_post_deps(post_deps, args->nr_out_syncobjs, submit->user_fence); out: submit_cleanup(submit, !!ret); if (has_ww_ticket) ww_acquire_fini(&submit->ticket); out_unlock: - if (ret && (out_fence_fd >= 0)) - put_unused_fd(out_fence_fd); mutex_unlock(&queue->lock); out_post_unlock: - msm_gem_submit_put(submit); + if (ret && (out_fence_fd >= 0)) + put_unused_fd(out_fence_fd); + if (submit) { + msm_gem_submit_put(submit); + } else { + /* + * If the submit hasn't yet taken ownership of the queue + * then we need to drop the reference ourself: + */ + msm_submitqueue_put(queue); + } if (!IS_ERR_OR_NULL(post_deps)) { for (i = 0; i < args->nr_out_syncobjs; ++i) { kfree(post_deps[i].chain); drm_syncobj_put(post_deps[i].syncobj); } kfree(post_deps); } if (!IS_ERR_OR_NULL(syncobjs_to_reset)) { for (i = 0; i < args->nr_in_syncobjs; ++i) {