| Message ID | 20240822084342.1574914-5-link@vivo.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | udmbuf bug fix and some improvements | expand |
Hi Huan, > Subject: [PATCH v4 4/5] udmabuf: udmabuf_create codestyle cleanup > > There are some variables in udmabuf_create that are only used inside the > loop. Therefore, there is no need to declare them outside the scope. > This patch moved it into loop. > > It is difficult to understand the loop condition of the code that adds > folio to the unpin_list. > > This patch move item folio pin and record into a single function, when > pinned success, the outer loop of this patch iterates through folios, > while the inner loop correctly sets the folio and corresponding offset > into the udmabuf starting from the offset. if reach to pgcnt or nr_folios, > end of loop. > > If item size is huge, folios may use vmalloc to get memory, which can't > cache but return into pcp(or buddy) when vfree. So, each pin may waste > some time in folios array alloc. > This patch also reuse of folios when iter create head, just use max size > of item. > > Signed-off-by: Huan Yang <link@vivo.com> > --- > drivers/dma-buf/udmabuf.c | 165 +++++++++++++++++++++++--------------- > 1 file changed, 101 insertions(+), 64 deletions(-) > > diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c > index 0bbc9df36c0a..eb55bb4a5fcc 100644 > --- a/drivers/dma-buf/udmabuf.c > +++ b/drivers/dma-buf/udmabuf.c > @@ -321,17 +321,87 @@ static int export_udmabuf(struct udmabuf *ubuf, > return dma_buf_fd(buf, flags); > } > > +static int __udmabuf_pin_list_folios(struct udmabuf_create_item *item, I think the name udmabuf_pin_folios() for this function would be simple and apt. > + struct udmabuf *ubuf, > + struct folio **folios) > +{ > + struct file *memfd = NULL; > + pgoff_t pgoff, ipgcnt, upgcnt = ubuf->pagecount; > + u32 cur_folio, cur_pgcnt; > + struct folio **ubuf_folios; > + pgoff_t *ubuf_offsets; > + long nr_folios; > + loff_t end, start; > + int ret; > + > + memfd = fget(item->memfd); > + ret = check_memfd_seals(memfd); > + if (ret < 0) > + goto err; Please move the above hunk to udmabuf_create(). Lets just have pinning and processing of folios in this function. > + > + start = item->offset; > + ipgcnt = item->size >> PAGE_SHIFT; I think it would be a bit more clear to have udmabuf_create() pass start and size values directly to this function instead of item. And rename ipgcnt to something like subpgcnt or nr_subpgs. > + end = start + (ipgcnt << PAGE_SHIFT) - 1; > + > + nr_folios = memfd_pin_folios(memfd, start, end, folios, ipgcnt, > &pgoff); > + if (nr_folios <= 0) { > + kvfree(folios); Please free folios in udmabuf_create() which is where it was allocated. > + ret = nr_folios ? nr_folios : -EINVAL; > + goto err; > + } > + > + cur_pgcnt = 0; > + ubuf_folios = ubuf->folios; > + ubuf_offsets = ubuf->offsets; Please initialize these temp variables at declaration time above. No strong opinion but I am not sure if they are really helpful here. Something like upgcnt would be OK as it definitely improves readability. > + > + for (cur_folio = 0; cur_folio < nr_folios; ++cur_folio) { > + pgoff_t subpgoff = pgoff; > + long fsize = folio_size(folios[cur_folio]); The return type for folio_size() is size_t. Please use that for consistency. > + > + ret = add_to_unpin_list(&ubuf->unpin_list, folios[cur_folio]); > + if (ret < 0) { > + kfree(folios); > + goto err; > + } > + > + for (; subpgoff < fsize; subpgoff += PAGE_SIZE) { > + ubuf->folios[upgcnt] = folios[cur_folio]; > + ubuf->offsets[upgcnt] = subpgoff; > + ++upgcnt; > + > + if (++cur_pgcnt >= ipgcnt) > + goto end; > + } > + > + /** > + * Only first folio in item may start from offset, I prefer to use the term range instead of item, in this context. > + * so remain folio start from 0. > + */ > + pgoff = 0; > + } > +end: > + ubuf->pagecount = upgcnt; > + fput(memfd); > + > + return 0; > + > +err: > + ubuf->pagecount = upgcnt; > + if (memfd) > + fput(memfd); > + > + return ret; > +} > + > static long udmabuf_create(struct miscdevice *device, > struct udmabuf_create_list *head, > struct udmabuf_create_item *list) > { > - pgoff_t pgoff, pgcnt, pglimit, pgbuf = 0; > - long nr_folios, ret = -EINVAL; > - struct file *memfd = NULL; > - struct folio **folios; > + pgoff_t pgcnt = 0, pglimit, max_ipgcnt = 0; > + long ret = -EINVAL; > struct udmabuf *ubuf; > - u32 i, j, k, flags; > - loff_t end; > + struct folio **folios = NULL; > + u32 i, flags; > > ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL); > if (!ubuf) > @@ -340,82 +410,50 @@ static long udmabuf_create(struct miscdevice > *device, > INIT_LIST_HEAD(&ubuf->unpin_list); > pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT; > for (i = 0; i < head->count; i++) { > - if (!IS_ALIGNED(list[i].offset, PAGE_SIZE)) > + pgoff_t itempgcnt; > + > + if (!PAGE_ALIGNED(list[i].offset)) > goto err; > - if (!IS_ALIGNED(list[i].size, PAGE_SIZE)) > + if (!PAGE_ALIGNED(list[i].size)) > goto err; > - ubuf->pagecount += list[i].size >> PAGE_SHIFT; > - if (ubuf->pagecount > pglimit) > + > + itempgcnt = list[i].size >> PAGE_SHIFT; > + pgcnt += itempgcnt; > + > + if (pgcnt > pglimit) > goto err; > + > + max_ipgcnt = max_t(unsigned long, itempgcnt, max_ipgcnt); Is this optimization really necessary given that, in practice, the userspace provides only a few ranges? It can stay but please pull these changes into a separate patch. Thanks, Vivek > } > > - if (!ubuf->pagecount) > + if (!pgcnt) > goto err; > > - ubuf->folios = kvmalloc_array(ubuf->pagecount, sizeof(*ubuf- > >folios), > + ubuf->folios = kvmalloc_array(pgcnt, sizeof(*ubuf->folios), > GFP_KERNEL); > if (!ubuf->folios) { > ret = -ENOMEM; > goto err; > } > - ubuf->offsets = kvcalloc(ubuf->pagecount, sizeof(*ubuf->offsets), > - GFP_KERNEL); > + > + ubuf->offsets = kvcalloc(pgcnt, sizeof(*ubuf->offsets), GFP_KERNEL); > if (!ubuf->offsets) { > ret = -ENOMEM; > goto err; > } > > - pgbuf = 0; > - for (i = 0; i < head->count; i++) { > - memfd = fget(list[i].memfd); > - ret = check_memfd_seals(memfd); > - if (ret < 0) > - goto err; > - > - pgcnt = list[i].size >> PAGE_SHIFT; > - folios = kvmalloc_array(pgcnt, sizeof(*folios), GFP_KERNEL); > - if (!folios) { > - ret = -ENOMEM; > - goto err; > - } > + folios = kvmalloc_array(max_ipgcnt, sizeof(*folios), GFP_KERNEL); > + if (!folios) { > + ret = -ENOMEM; > + goto err; > + } > > - end = list[i].offset + (pgcnt << PAGE_SHIFT) - 1; > - ret = memfd_pin_folios(memfd, list[i].offset, end, > - folios, pgcnt, &pgoff); > - if (ret <= 0) { > - kvfree(folios); > - if (!ret) > - ret = -EINVAL; > + for (i = 0; i < head->count; i++) { > + ret = __udmabuf_pin_list_folios(&list[i], ubuf, folios); > + if (ret) > goto err; > - } > - > - nr_folios = ret; > - pgoff >>= PAGE_SHIFT; > - for (j = 0, k = 0; j < pgcnt; j++) { > - ubuf->folios[pgbuf] = folios[k]; > - ubuf->offsets[pgbuf] = pgoff << PAGE_SHIFT; > - > - if (j == 0 || ubuf->folios[pgbuf-1] != folios[k]) { > - ret = add_to_unpin_list(&ubuf->unpin_list, > - folios[k]); > - if (ret < 0) { > - kfree(folios); > - goto err; > - } > - } > - > - pgbuf++; > - if (++pgoff == folio_nr_pages(folios[k])) { > - pgoff = 0; > - if (++k == nr_folios) > - break; > - } > - } > - > - kvfree(folios); > - fput(memfd); > - memfd = NULL; > } > + kvfree(folios); > > flags = head->flags & UDMABUF_FLAGS_CLOEXEC ? O_CLOEXEC : 0; > ret = export_udmabuf(ubuf, device, flags); > @@ -425,9 +463,8 @@ static long udmabuf_create(struct miscdevice > *device, > return ret; > > err: > - if (memfd) > - fput(memfd); > unpin_all_folios(&ubuf->unpin_list); > + kvfree(folios); > kvfree(ubuf->offsets); > kvfree(ubuf->folios); > kfree(ubuf); > -- > 2.45.2
在 2024/8/29 14:39, Kasireddy, Vivek 写道: > Hi Huan, > >> Subject: [PATCH v4 4/5] udmabuf: udmabuf_create codestyle cleanup >> >> There are some variables in udmabuf_create that are only used inside the >> loop. Therefore, there is no need to declare them outside the scope. >> This patch moved it into loop. >> >> It is difficult to understand the loop condition of the code that adds >> folio to the unpin_list. >> >> This patch move item folio pin and record into a single function, when >> pinned success, the outer loop of this patch iterates through folios, >> while the inner loop correctly sets the folio and corresponding offset >> into the udmabuf starting from the offset. if reach to pgcnt or nr_folios, >> end of loop. >> >> If item size is huge, folios may use vmalloc to get memory, which can't >> cache but return into pcp(or buddy) when vfree. So, each pin may waste >> some time in folios array alloc. >> This patch also reuse of folios when iter create head, just use max size >> of item. >> >> Signed-off-by: Huan Yang <link@vivo.com> >> --- >> drivers/dma-buf/udmabuf.c | 165 +++++++++++++++++++++++--------------- >> 1 file changed, 101 insertions(+), 64 deletions(-) >> >> diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c >> index 0bbc9df36c0a..eb55bb4a5fcc 100644 >> --- a/drivers/dma-buf/udmabuf.c >> +++ b/drivers/dma-buf/udmabuf.c >> @@ -321,17 +321,87 @@ static int export_udmabuf(struct udmabuf *ubuf, >> return dma_buf_fd(buf, flags); >> } >> >> +static int __udmabuf_pin_list_folios(struct udmabuf_create_item *item, > I think the name udmabuf_pin_folios() for this function would be simple and apt. > >> + struct udmabuf *ubuf, >> + struct folio **folios) >> +{ >> + struct file *memfd = NULL; >> + pgoff_t pgoff, ipgcnt, upgcnt = ubuf->pagecount; >> + u32 cur_folio, cur_pgcnt; >> + struct folio **ubuf_folios; >> + pgoff_t *ubuf_offsets; >> + long nr_folios; >> + loff_t end, start; >> + int ret; >> + >> + memfd = fget(item->memfd); >> + ret = check_memfd_seals(memfd); >> + if (ret < 0) >> + goto err; > Please move the above hunk to udmabuf_create(). Lets just have pinning and > processing of folios in this function. > >> + >> + start = item->offset; >> + ipgcnt = item->size >> PAGE_SHIFT; > I think it would be a bit more clear to have udmabuf_create() pass start and size > values directly to this function instead of item. And rename ipgcnt to something > like subpgcnt or nr_subpgs. > >> + end = start + (ipgcnt << PAGE_SHIFT) - 1; >> + >> + nr_folios = memfd_pin_folios(memfd, start, end, folios, ipgcnt, >> &pgoff); >> + if (nr_folios <= 0) { >> + kvfree(folios); > Please free folios in udmabuf_create() which is where it was allocated. > >> + ret = nr_folios ? nr_folios : -EINVAL; >> + goto err; >> + } >> + >> + cur_pgcnt = 0; >> + ubuf_folios = ubuf->folios; >> + ubuf_offsets = ubuf->offsets; > Please initialize these temp variables at declaration time above. No strong > opinion but I am not sure if they are really helpful here. Something like > upgcnt would be OK as it definitely improves readability. > >> + >> + for (cur_folio = 0; cur_folio < nr_folios; ++cur_folio) { >> + pgoff_t subpgoff = pgoff; >> + long fsize = folio_size(folios[cur_folio]); > The return type for folio_size() is size_t. Please use that for consistency. > >> + >> + ret = add_to_unpin_list(&ubuf->unpin_list, folios[cur_folio]); >> + if (ret < 0) { >> + kfree(folios); >> + goto err; >> + } >> + >> + for (; subpgoff < fsize; subpgoff += PAGE_SIZE) { >> + ubuf->folios[upgcnt] = folios[cur_folio]; >> + ubuf->offsets[upgcnt] = subpgoff; >> + ++upgcnt; >> + >> + if (++cur_pgcnt >= ipgcnt) >> + goto end; >> + } >> + >> + /** >> + * Only first folio in item may start from offset, > I prefer to use the term range instead of item, in this context. All above I'll rework. > >> + * so remain folio start from 0. >> + */ >> + pgoff = 0; >> + } >> +end: >> + ubuf->pagecount = upgcnt; >> + fput(memfd); >> + >> + return 0; >> + >> +err: >> + ubuf->pagecount = upgcnt; >> + if (memfd) >> + fput(memfd); >> + >> + return ret; >> +} >> + >> static long udmabuf_create(struct miscdevice *device, >> struct udmabuf_create_list *head, >> struct udmabuf_create_item *list) >> { >> - pgoff_t pgoff, pgcnt, pglimit, pgbuf = 0; >> - long nr_folios, ret = -EINVAL; >> - struct file *memfd = NULL; >> - struct folio **folios; >> + pgoff_t pgcnt = 0, pglimit, max_ipgcnt = 0; >> + long ret = -EINVAL; >> struct udmabuf *ubuf; >> - u32 i, j, k, flags; >> - loff_t end; >> + struct folio **folios = NULL; >> + u32 i, flags; >> >> ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL); >> if (!ubuf) >> @@ -340,82 +410,50 @@ static long udmabuf_create(struct miscdevice >> *device, >> INIT_LIST_HEAD(&ubuf->unpin_list); >> pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT; >> for (i = 0; i < head->count; i++) { >> - if (!IS_ALIGNED(list[i].offset, PAGE_SIZE)) >> + pgoff_t itempgcnt; >> + >> + if (!PAGE_ALIGNED(list[i].offset)) >> goto err; >> - if (!IS_ALIGNED(list[i].size, PAGE_SIZE)) >> + if (!PAGE_ALIGNED(list[i].size)) >> goto err; >> - ubuf->pagecount += list[i].size >> PAGE_SHIFT; >> - if (ubuf->pagecount > pglimit) >> + >> + itempgcnt = list[i].size >> PAGE_SHIFT; >> + pgcnt += itempgcnt; >> + >> + if (pgcnt > pglimit) >> goto err; >> + >> + max_ipgcnt = max_t(unsigned long, itempgcnt, max_ipgcnt); > Is this optimization really necessary given that, in practice, the userspace provides > only a few ranges? It can stay but please pull these changes into a separate patch. OK, I'll separate it. If few ranges, folios can alloc from kmalloc, if low, from slub is fast. If low than PCP order, also fast. But if trigger vmalloc, I think it's slow more. Consider 3GB udmabuf create(even if currently not used) page array will cost 6MB, from vmalloc will iter alloc 4K page upon to 1536 time. So, a little help if only reuse the max size folio. Thanks for your suggestions. > > Thanks, > Vivek > >> } >> >> - if (!ubuf->pagecount) >> + if (!pgcnt) >> goto err; >> >> - ubuf->folios = kvmalloc_array(ubuf->pagecount, sizeof(*ubuf- >>> folios), >> + ubuf->folios = kvmalloc_array(pgcnt, sizeof(*ubuf->folios), >> GFP_KERNEL); >> if (!ubuf->folios) { >> ret = -ENOMEM; >> goto err; >> } >> - ubuf->offsets = kvcalloc(ubuf->pagecount, sizeof(*ubuf->offsets), >> - GFP_KERNEL); >> + >> + ubuf->offsets = kvcalloc(pgcnt, sizeof(*ubuf->offsets), GFP_KERNEL); >> if (!ubuf->offsets) { >> ret = -ENOMEM; >> goto err; >> } >> >> - pgbuf = 0; >> - for (i = 0; i < head->count; i++) { >> - memfd = fget(list[i].memfd); >> - ret = check_memfd_seals(memfd); >> - if (ret < 0) >> - goto err; >> - >> - pgcnt = list[i].size >> PAGE_SHIFT; >> - folios = kvmalloc_array(pgcnt, sizeof(*folios), GFP_KERNEL); >> - if (!folios) { >> - ret = -ENOMEM; >> - goto err; >> - } >> + folios = kvmalloc_array(max_ipgcnt, sizeof(*folios), GFP_KERNEL); >> + if (!folios) { >> + ret = -ENOMEM; >> + goto err; >> + } >> >> - end = list[i].offset + (pgcnt << PAGE_SHIFT) - 1; >> - ret = memfd_pin_folios(memfd, list[i].offset, end, >> - folios, pgcnt, &pgoff); >> - if (ret <= 0) { >> - kvfree(folios); >> - if (!ret) >> - ret = -EINVAL; >> + for (i = 0; i < head->count; i++) { >> + ret = __udmabuf_pin_list_folios(&list[i], ubuf, folios); >> + if (ret) >> goto err; >> - } >> - >> - nr_folios = ret; >> - pgoff >>= PAGE_SHIFT; >> - for (j = 0, k = 0; j < pgcnt; j++) { >> - ubuf->folios[pgbuf] = folios[k]; >> - ubuf->offsets[pgbuf] = pgoff << PAGE_SHIFT; >> - >> - if (j == 0 || ubuf->folios[pgbuf-1] != folios[k]) { >> - ret = add_to_unpin_list(&ubuf->unpin_list, >> - folios[k]); >> - if (ret < 0) { >> - kfree(folios); >> - goto err; >> - } >> - } >> - >> - pgbuf++; >> - if (++pgoff == folio_nr_pages(folios[k])) { >> - pgoff = 0; >> - if (++k == nr_folios) >> - break; >> - } >> - } >> - >> - kvfree(folios); >> - fput(memfd); >> - memfd = NULL; >> } >> + kvfree(folios); >> >> flags = head->flags & UDMABUF_FLAGS_CLOEXEC ? O_CLOEXEC : 0; >> ret = export_udmabuf(ubuf, device, flags); >> @@ -425,9 +463,8 @@ static long udmabuf_create(struct miscdevice >> *device, >> return ret; >> >> err: >> - if (memfd) >> - fput(memfd); >> unpin_all_folios(&ubuf->unpin_list); >> + kvfree(folios); >> kvfree(ubuf->offsets); >> kvfree(ubuf->folios); >> kfree(ubuf); >> -- >> 2.45.2
Hi Huan,
kernel test robot noticed the following build warnings:
url: https://github.com/intel-lab-lkp/linux/commits/Huan-Yang/udmabuf-direct-map-pfn-when-first-page-fault/20240826-105359
base: 6a7917c89f219f09b1d88d09f376000914a52763
patch link: https://lore.kernel.org/r/20240822084342.1574914-5-link%40vivo.com
patch subject: [PATCH v4 4/5] udmabuf: udmabuf_create codestyle cleanup
config: x86_64-randconfig-161-20240829 (https://download.01.org/0day-ci/archive/20240829/202408291101.WAf552sW-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202408291101.WAf552sW-lkp@intel.com/
smatch warnings:
drivers/dma-buf/udmabuf.c:467 udmabuf_create() error: double free of 'folios'
vim +/folios +467 drivers/dma-buf/udmabuf.c
c1bbed66899726 Gurchetan Singh 2019-12-02 396 static long udmabuf_create(struct miscdevice *device,
c1bbed66899726 Gurchetan Singh 2019-12-02 397 struct udmabuf_create_list *head,
c1bbed66899726 Gurchetan Singh 2019-12-02 398 struct udmabuf_create_item *list)
fbb0de79507819 Gerd Hoffmann 2018-08-27 399 {
fb2c508270085b Huan Yang 2024-08-22 400 pgoff_t pgcnt = 0, pglimit, max_ipgcnt = 0;
fb2c508270085b Huan Yang 2024-08-22 401 long ret = -EINVAL;
fbb0de79507819 Gerd Hoffmann 2018-08-27 402 struct udmabuf *ubuf;
fb2c508270085b Huan Yang 2024-08-22 403 struct folio **folios = NULL;
fb2c508270085b Huan Yang 2024-08-22 404 u32 i, flags;
fbb0de79507819 Gerd Hoffmann 2018-08-27 405
33f35429fc49c0 Gerd Hoffmann 2018-09-11 406 ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL);
fbb0de79507819 Gerd Hoffmann 2018-08-27 407 if (!ubuf)
fbb0de79507819 Gerd Hoffmann 2018-08-27 408 return -ENOMEM;
fbb0de79507819 Gerd Hoffmann 2018-08-27 409
c6a3194c05e7e6 Vivek Kasireddy 2024-06-23 410 INIT_LIST_HEAD(&ubuf->unpin_list);
dc4716d75154b3 Gerd Hoffmann 2018-09-11 411 pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
fbb0de79507819 Gerd Hoffmann 2018-08-27 412 for (i = 0; i < head->count; i++) {
fb2c508270085b Huan Yang 2024-08-22 413 pgoff_t itempgcnt;
fb2c508270085b Huan Yang 2024-08-22 414
fb2c508270085b Huan Yang 2024-08-22 415 if (!PAGE_ALIGNED(list[i].offset))
0d17455ca85ecb Gerd Hoffmann 2018-09-11 416 goto err;
fb2c508270085b Huan Yang 2024-08-22 417 if (!PAGE_ALIGNED(list[i].size))
0d17455ca85ecb Gerd Hoffmann 2018-09-11 418 goto err;
fb2c508270085b Huan Yang 2024-08-22 419
fb2c508270085b Huan Yang 2024-08-22 420 itempgcnt = list[i].size >> PAGE_SHIFT;
fb2c508270085b Huan Yang 2024-08-22 421 pgcnt += itempgcnt;
fb2c508270085b Huan Yang 2024-08-22 422
fb2c508270085b Huan Yang 2024-08-22 423 if (pgcnt > pglimit)
0d17455ca85ecb Gerd Hoffmann 2018-09-11 424 goto err;
fb2c508270085b Huan Yang 2024-08-22 425
fb2c508270085b Huan Yang 2024-08-22 426 max_ipgcnt = max_t(unsigned long, itempgcnt, max_ipgcnt);
fbb0de79507819 Gerd Hoffmann 2018-08-27 427 }
2b6dd600dd7257 Pavel Skripkin 2021-12-30 428
fb2c508270085b Huan Yang 2024-08-22 429 if (!pgcnt)
2b6dd600dd7257 Pavel Skripkin 2021-12-30 430 goto err;
2b6dd600dd7257 Pavel Skripkin 2021-12-30 431
fb2c508270085b Huan Yang 2024-08-22 432 ubuf->folios = kvmalloc_array(pgcnt, sizeof(*ubuf->folios),
fbb0de79507819 Gerd Hoffmann 2018-08-27 433 GFP_KERNEL);
5e72b2b41a21e5 Vivek Kasireddy 2024-06-23 434 if (!ubuf->folios) {
fbb0de79507819 Gerd Hoffmann 2018-08-27 435 ret = -ENOMEM;
0d17455ca85ecb Gerd Hoffmann 2018-09-11 436 goto err;
fbb0de79507819 Gerd Hoffmann 2018-08-27 437 }
fb2c508270085b Huan Yang 2024-08-22 438
fb2c508270085b Huan Yang 2024-08-22 439 ubuf->offsets = kvcalloc(pgcnt, sizeof(*ubuf->offsets), GFP_KERNEL);
0c8b91ef5100ea Vivek Kasireddy 2024-06-23 440 if (!ubuf->offsets) {
0c8b91ef5100ea Vivek Kasireddy 2024-06-23 441 ret = -ENOMEM;
0c8b91ef5100ea Vivek Kasireddy 2024-06-23 442 goto err;
0c8b91ef5100ea Vivek Kasireddy 2024-06-23 443 }
fbb0de79507819 Gerd Hoffmann 2018-08-27 444
fb2c508270085b Huan Yang 2024-08-22 445 folios = kvmalloc_array(max_ipgcnt, sizeof(*folios), GFP_KERNEL);
c6a3194c05e7e6 Vivek Kasireddy 2024-06-23 446 if (!folios) {
c6a3194c05e7e6 Vivek Kasireddy 2024-06-23 447 ret = -ENOMEM;
c6a3194c05e7e6 Vivek Kasireddy 2024-06-23 448 goto err;
c6a3194c05e7e6 Vivek Kasireddy 2024-06-23 449 }
c6a3194c05e7e6 Vivek Kasireddy 2024-06-23 450
fb2c508270085b Huan Yang 2024-08-22 451 for (i = 0; i < head->count; i++) {
fb2c508270085b Huan Yang 2024-08-22 452 ret = __udmabuf_pin_list_folios(&list[i], ubuf, folios);
There is a kfree(folios) hidden inside this function. It doesn't belong there.
fb2c508270085b Huan Yang 2024-08-22 453 if (ret)
0d17455ca85ecb Gerd Hoffmann 2018-09-11 454 goto err;
c6a3194c05e7e6 Vivek Kasireddy 2024-06-23 455 }
452dc1b0221804 Huan Yang 2024-08-22 456 kvfree(folios);
^^^^^^^^^^^^^^
A second free
fbb0de79507819 Gerd Hoffmann 2018-08-27 457
5e72b2b41a21e5 Vivek Kasireddy 2024-06-23 458 flags = head->flags & UDMABUF_FLAGS_CLOEXEC ? O_CLOEXEC : 0;
5e72b2b41a21e5 Vivek Kasireddy 2024-06-23 459 ret = export_udmabuf(ubuf, device, flags);
5e72b2b41a21e5 Vivek Kasireddy 2024-06-23 460 if (ret < 0)
0d17455ca85ecb Gerd Hoffmann 2018-09-11 461 goto err;
^^^^^^^^
fbb0de79507819 Gerd Hoffmann 2018-08-27 462
5e72b2b41a21e5 Vivek Kasireddy 2024-06-23 463 return ret;
fbb0de79507819 Gerd Hoffmann 2018-08-27 464
0d17455ca85ecb Gerd Hoffmann 2018-09-11 465 err:
c6a3194c05e7e6 Vivek Kasireddy 2024-06-23 466 unpin_all_folios(&ubuf->unpin_list);
fb2c508270085b Huan Yang 2024-08-22 @467 kvfree(folios);
^^^^^^^^^^^^^
Double free
452dc1b0221804 Huan Yang 2024-08-22 468 kvfree(ubuf->offsets);
452dc1b0221804 Huan Yang 2024-08-22 469 kvfree(ubuf->folios);
fbb0de79507819 Gerd Hoffmann 2018-08-27 470 kfree(ubuf);
fbb0de79507819 Gerd Hoffmann 2018-08-27 471 return ret;
fbb0de79507819 Gerd Hoffmann 2018-08-27 472 }
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c index 0bbc9df36c0a..eb55bb4a5fcc 100644 --- a/drivers/dma-buf/udmabuf.c +++ b/drivers/dma-buf/udmabuf.c @@ -321,17 +321,87 @@ static int export_udmabuf(struct udmabuf *ubuf, return dma_buf_fd(buf, flags); } +static int __udmabuf_pin_list_folios(struct udmabuf_create_item *item, + struct udmabuf *ubuf, + struct folio **folios) +{ + struct file *memfd = NULL; + pgoff_t pgoff, ipgcnt, upgcnt = ubuf->pagecount; + u32 cur_folio, cur_pgcnt; + struct folio **ubuf_folios; + pgoff_t *ubuf_offsets; + long nr_folios; + loff_t end, start; + int ret; + + memfd = fget(item->memfd); + ret = check_memfd_seals(memfd); + if (ret < 0) + goto err; + + start = item->offset; + ipgcnt = item->size >> PAGE_SHIFT; + end = start + (ipgcnt << PAGE_SHIFT) - 1; + + nr_folios = memfd_pin_folios(memfd, start, end, folios, ipgcnt, &pgoff); + if (nr_folios <= 0) { + kvfree(folios); + ret = nr_folios ? nr_folios : -EINVAL; + goto err; + } + + cur_pgcnt = 0; + ubuf_folios = ubuf->folios; + ubuf_offsets = ubuf->offsets; + + for (cur_folio = 0; cur_folio < nr_folios; ++cur_folio) { + pgoff_t subpgoff = pgoff; + long fsize = folio_size(folios[cur_folio]); + + ret = add_to_unpin_list(&ubuf->unpin_list, folios[cur_folio]); + if (ret < 0) { + kfree(folios); + goto err; + } + + for (; subpgoff < fsize; subpgoff += PAGE_SIZE) { + ubuf->folios[upgcnt] = folios[cur_folio]; + ubuf->offsets[upgcnt] = subpgoff; + ++upgcnt; + + if (++cur_pgcnt >= ipgcnt) + goto end; + } + + /** + * Only first folio in item may start from offset, + * so remain folio start from 0. + */ + pgoff = 0; + } +end: + ubuf->pagecount = upgcnt; + fput(memfd); + + return 0; + +err: + ubuf->pagecount = upgcnt; + if (memfd) + fput(memfd); + + return ret; +} + static long udmabuf_create(struct miscdevice *device, struct udmabuf_create_list *head, struct udmabuf_create_item *list) { - pgoff_t pgoff, pgcnt, pglimit, pgbuf = 0; - long nr_folios, ret = -EINVAL; - struct file *memfd = NULL; - struct folio **folios; + pgoff_t pgcnt = 0, pglimit, max_ipgcnt = 0; + long ret = -EINVAL; struct udmabuf *ubuf; - u32 i, j, k, flags; - loff_t end; + struct folio **folios = NULL; + u32 i, flags; ubuf = kzalloc(sizeof(*ubuf), GFP_KERNEL); if (!ubuf) @@ -340,82 +410,50 @@ static long udmabuf_create(struct miscdevice *device, INIT_LIST_HEAD(&ubuf->unpin_list); pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT; for (i = 0; i < head->count; i++) { - if (!IS_ALIGNED(list[i].offset, PAGE_SIZE)) + pgoff_t itempgcnt; + + if (!PAGE_ALIGNED(list[i].offset)) goto err; - if (!IS_ALIGNED(list[i].size, PAGE_SIZE)) + if (!PAGE_ALIGNED(list[i].size)) goto err; - ubuf->pagecount += list[i].size >> PAGE_SHIFT; - if (ubuf->pagecount > pglimit) + + itempgcnt = list[i].size >> PAGE_SHIFT; + pgcnt += itempgcnt; + + if (pgcnt > pglimit) goto err; + + max_ipgcnt = max_t(unsigned long, itempgcnt, max_ipgcnt); } - if (!ubuf->pagecount) + if (!pgcnt) goto err; - ubuf->folios = kvmalloc_array(ubuf->pagecount, sizeof(*ubuf->folios), + ubuf->folios = kvmalloc_array(pgcnt, sizeof(*ubuf->folios), GFP_KERNEL); if (!ubuf->folios) { ret = -ENOMEM; goto err; } - ubuf->offsets = kvcalloc(ubuf->pagecount, sizeof(*ubuf->offsets), - GFP_KERNEL); + + ubuf->offsets = kvcalloc(pgcnt, sizeof(*ubuf->offsets), GFP_KERNEL); if (!ubuf->offsets) { ret = -ENOMEM; goto err; } - pgbuf = 0; - for (i = 0; i < head->count; i++) { - memfd = fget(list[i].memfd); - ret = check_memfd_seals(memfd); - if (ret < 0) - goto err; - - pgcnt = list[i].size >> PAGE_SHIFT; - folios = kvmalloc_array(pgcnt, sizeof(*folios), GFP_KERNEL); - if (!folios) { - ret = -ENOMEM; - goto err; - } + folios = kvmalloc_array(max_ipgcnt, sizeof(*folios), GFP_KERNEL); + if (!folios) { + ret = -ENOMEM; + goto err; + } - end = list[i].offset + (pgcnt << PAGE_SHIFT) - 1; - ret = memfd_pin_folios(memfd, list[i].offset, end, - folios, pgcnt, &pgoff); - if (ret <= 0) { - kvfree(folios); - if (!ret) - ret = -EINVAL; + for (i = 0; i < head->count; i++) { + ret = __udmabuf_pin_list_folios(&list[i], ubuf, folios); + if (ret) goto err; - } - - nr_folios = ret; - pgoff >>= PAGE_SHIFT; - for (j = 0, k = 0; j < pgcnt; j++) { - ubuf->folios[pgbuf] = folios[k]; - ubuf->offsets[pgbuf] = pgoff << PAGE_SHIFT; - - if (j == 0 || ubuf->folios[pgbuf-1] != folios[k]) { - ret = add_to_unpin_list(&ubuf->unpin_list, - folios[k]); - if (ret < 0) { - kfree(folios); - goto err; - } - } - - pgbuf++; - if (++pgoff == folio_nr_pages(folios[k])) { - pgoff = 0; - if (++k == nr_folios) - break; - } - } - - kvfree(folios); - fput(memfd); - memfd = NULL; } + kvfree(folios); flags = head->flags & UDMABUF_FLAGS_CLOEXEC ? O_CLOEXEC : 0; ret = export_udmabuf(ubuf, device, flags); @@ -425,9 +463,8 @@ static long udmabuf_create(struct miscdevice *device, return ret; err: - if (memfd) - fput(memfd); unpin_all_folios(&ubuf->unpin_list); + kvfree(folios); kvfree(ubuf->offsets); kvfree(ubuf->folios); kfree(ubuf);
There are some variables in udmabuf_create that are only used inside the loop. Therefore, there is no need to declare them outside the scope. This patch moved it into loop. It is difficult to understand the loop condition of the code that adds folio to the unpin_list. This patch move item folio pin and record into a single function, when pinned success, the outer loop of this patch iterates through folios, while the inner loop correctly sets the folio and corresponding offset into the udmabuf starting from the offset. if reach to pgcnt or nr_folios, end of loop. If item size is huge, folios may use vmalloc to get memory, which can't cache but return into pcp(or buddy) when vfree. So, each pin may waste some time in folios array alloc. This patch also reuse of folios when iter create head, just use max size of item. Signed-off-by: Huan Yang <link@vivo.com> --- drivers/dma-buf/udmabuf.c | 165 +++++++++++++++++++++++--------------- 1 file changed, 101 insertions(+), 64 deletions(-)