From nobody Fri Apr 10 20:26:24 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B35EFC32771 for ; Fri, 19 Aug 2022 07:34:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343573AbiHSHeA (ORCPT ); Fri, 19 Aug 2022 03:34:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46240 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242638AbiHSHd5 (ORCPT ); Fri, 19 Aug 2022 03:33:57 -0400 Received: from mail-m11885.qiye.163.com (mail-m11885.qiye.163.com [115.236.118.85]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BA8976BCF3; Fri, 19 Aug 2022 00:33:53 -0700 (PDT) Received: from localhost (unknown [103.29.142.67]) by mail-m11885.qiye.163.com (Hmail) with ESMTPA id 5AF324C02BD; Fri, 19 Aug 2022 15:33:51 +0800 (CST) From: Jeffy Chen To: Daniel Vetter Cc: Andy Yan , Jianqun Xu , Jeffy Chen , =?UTF-8?q?Christian=20K=C3=B6nig?= , Maxime Ripard , Sumit Semwal , Thomas Zimmermann , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, David Airlie , Maarten Lankhorst , linux-media@vger.kernel.org, Daniel Vetter Subject: [PATCH v3] drm/gem: Fix GEM handle release errors Date: Fri, 19 Aug 2022 15:28:34 +0800 Message-Id: <20220819072834.17888-1-jeffy.chen@rock-chips.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-HM-Spam-Status: e1kfGhgUHx5ZQUtXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWS1ZQUlXWQ8JGhUIEh9ZQVkZTh4fVk9MHk4fQxlKGE9DS1UTARMWGhIXJBQOD1 lXWRgSC1lBWUpLSFVJQlVKT0lVTUxZV1kWGg8SFR0UWUFZT0tIVUpKS0hKQ1VLWQY+ X-HM-Sender-Digest: e1kMHhlZQR0aFwgeV1kSHx4VD1lBWUc6OQw6Hgw*IT0wCRYyFh9NEEMj DCswFDNVSlVKTU1LQ0JPT0hKQk9IVTMWGhIXVREeHR0CVRgTHhU7CRQYEFYYExILCFUYFBZFWVdZ EgtZQVlKS0hVSUJVSk9JVU1MWVdZCAFZQU1KT043Bg++ X-HM-Tid: 0a82b505c8ac2eb9kusn5af324c02bd Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Currently we are assuming a one to one mapping between dmabuf and GEM handle when releasing GEM handles. But that is not always true, since we would create extra handles for the GEM obj in cases like gem_open() and getfb{,2}(). A similar issue was reported at: https://lore.kernel.org/all/20211105083308.392156-1-jay.xu@rock-chips.com/ Another problem is that the imported dmabuf might not always have gem_obj->dma_buf set, which would cause leaks in drm_gem_remove_prime_handles(). Let's fix these for now by using handle to find the exact map to remove. Signed-off-by: Jeffy Chen Reviewed-by: Christian K=C3=B6nig --- Changes in v3: Rewrite commit message a bit. Changes in v2: Fix a typo of rbtree. drivers/gpu/drm/drm_gem.c | 17 +---------------- drivers/gpu/drm/drm_internal.h | 4 ++-- drivers/gpu/drm/drm_prime.c | 20 ++++++++++++-------- 3 files changed, 15 insertions(+), 26 deletions(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index eb0c2d041f13..ed39da383570 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -168,21 +168,6 @@ void drm_gem_private_object_init(struct drm_device *de= v, } EXPORT_SYMBOL(drm_gem_private_object_init); =20 -static void -drm_gem_remove_prime_handles(struct drm_gem_object *obj, struct drm_file *= filp) -{ - /* - * Note: obj->dma_buf can't disappear as long as we still hold a - * handle reference in obj->handle_count. - */ - mutex_lock(&filp->prime.lock); - if (obj->dma_buf) { - drm_prime_remove_buf_handle_locked(&filp->prime, - obj->dma_buf); - } - mutex_unlock(&filp->prime.lock); -} - /** * drm_gem_object_handle_free - release resources bound to userspace handl= es * @obj: GEM object to clean up. @@ -253,7 +238,7 @@ drm_gem_object_release_handle(int id, void *ptr, void *= data) if (obj->funcs->close) obj->funcs->close(obj, file_priv); =20 - drm_gem_remove_prime_handles(obj, file_priv); + drm_prime_remove_buf_handle(&file_priv->prime, id); drm_vma_node_revoke(&obj->vma_node, file_priv); =20 drm_gem_object_handle_put_unlocked(obj); diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h index 1fbbc19f1ac0..7bb98e6a446d 100644 --- a/drivers/gpu/drm/drm_internal.h +++ b/drivers/gpu/drm/drm_internal.h @@ -74,8 +74,8 @@ int drm_prime_fd_to_handle_ioctl(struct drm_device *dev, = void *data, =20 void drm_prime_init_file_private(struct drm_prime_file_private *prime_fpri= v); void drm_prime_destroy_file_private(struct drm_prime_file_private *prime_f= priv); -void drm_prime_remove_buf_handle_locked(struct drm_prime_file_private *pri= me_fpriv, - struct dma_buf *dma_buf); +void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpri= v, + uint32_t handle); =20 /* drm_drv.c */ struct drm_minor *drm_minor_acquire(unsigned int minor_id); diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c index e3f09f18110c..bd5366b16381 100644 --- a/drivers/gpu/drm/drm_prime.c +++ b/drivers/gpu/drm/drm_prime.c @@ -190,29 +190,33 @@ static int drm_prime_lookup_buf_handle(struct drm_pri= me_file_private *prime_fpri return -ENOENT; } =20 -void drm_prime_remove_buf_handle_locked(struct drm_prime_file_private *pri= me_fpriv, - struct dma_buf *dma_buf) +void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpri= v, + uint32_t handle) { struct rb_node *rb; =20 - rb =3D prime_fpriv->dmabufs.rb_node; + mutex_lock(&prime_fpriv->lock); + + rb =3D prime_fpriv->handles.rb_node; while (rb) { struct drm_prime_member *member; =20 - member =3D rb_entry(rb, struct drm_prime_member, dmabuf_rb); - if (member->dma_buf =3D=3D dma_buf) { + member =3D rb_entry(rb, struct drm_prime_member, handle_rb); + if (member->handle =3D=3D handle) { rb_erase(&member->handle_rb, &prime_fpriv->handles); rb_erase(&member->dmabuf_rb, &prime_fpriv->dmabufs); =20 - dma_buf_put(dma_buf); + dma_buf_put(member->dma_buf); kfree(member); - return; - } else if (member->dma_buf < dma_buf) { + break; + } else if (member->handle < handle) { rb =3D rb->rb_right; } else { rb =3D rb->rb_left; } } + + mutex_unlock(&prime_fpriv->lock); } =20 void drm_prime_init_file_private(struct drm_prime_file_private *prime_fpri= v) --=20 2.20.1