From nobody Fri Dec 19 07:48:45 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4049BC54EE9 for ; Tue, 13 Sep 2022 14:09:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232562AbiIMOJC (ORCPT ); Tue, 13 Sep 2022 10:09:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50170 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232478AbiIMOI3 (ORCPT ); Tue, 13 Sep 2022 10:08:29 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B143F5C349; Tue, 13 Sep 2022 07:08:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B33BD614AC; Tue, 13 Sep 2022 14:08:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B930BC433C1; Tue, 13 Sep 2022 14:08:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078093; bh=8WnNtHa6kyBxKAB9Qe4GYjamla7EnOs3bQQ3ef5zjTY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=S42P8Oy54CFbDX+rI5FrJ5hPsUDe3Acc5DYBqWjcV4qPbTHm1wY82a/re0x0Xjlra yjNfESNQJQ0iBFoPoExqfDjO1/XUhTnBhE3dzPJLTev9y4kEBXS67EDdlxdaJkJwuy X3xwN7ZIKTKnN2mrMtz2tNutn13ox8pOHUjlFd7E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jeffy Chen , =?UTF-8?q?Christian=20K=C3=B6nig?= , Sasha Levin Subject: [PATCH 5.19 012/192] drm/gem: Fix GEM handle release errors Date: Tue, 13 Sep 2022 16:01:58 +0200 Message-Id: <20220913140410.568379680@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140410.043243217@linuxfoundation.org> References: <20220913140410.043243217@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jeffy Chen [ Upstream commit ea2aa97ca37a9044ade001aef71dbc06318e8d44 ] Currently we are assuming a one to one mapping between dmabuf and GEM handle when releasing GEM handles. But that is not always true, since we would create extra handles for the GEM obj in cases like gem_open() and getfb{,2}(). A similar issue was reported at: https://lore.kernel.org/all/20211105083308.392156-1-jay.xu@rock-chips.com/ Another problem is that the imported dmabuf might not always have gem_obj->dma_buf set, which would cause leaks in drm_gem_remove_prime_handles(). Let's fix these for now by using handle to find the exact map to remove. Signed-off-by: Jeffy Chen Reviewed-by: Christian K=C3=B6nig Signed-off-by: Christian K=C3=B6nig Link: https://patchwork.freedesktop.org/patch/msgid/20220819072834.17888-1-= jeffy.chen@rock-chips.com Signed-off-by: Sasha Levin --- drivers/gpu/drm/drm_gem.c | 17 +---------------- drivers/gpu/drm/drm_internal.h | 4 ++-- drivers/gpu/drm/drm_prime.c | 20 ++++++++++++-------- 3 files changed, 15 insertions(+), 26 deletions(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 86d670c712867..ad068865ba206 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -168,21 +168,6 @@ void drm_gem_private_object_init(struct drm_device *de= v, } EXPORT_SYMBOL(drm_gem_private_object_init); =20 -static void -drm_gem_remove_prime_handles(struct drm_gem_object *obj, struct drm_file *= filp) -{ - /* - * Note: obj->dma_buf can't disappear as long as we still hold a - * handle reference in obj->handle_count. - */ - mutex_lock(&filp->prime.lock); - if (obj->dma_buf) { - drm_prime_remove_buf_handle_locked(&filp->prime, - obj->dma_buf); - } - mutex_unlock(&filp->prime.lock); -} - /** * drm_gem_object_handle_free - release resources bound to userspace handl= es * @obj: GEM object to clean up. @@ -253,7 +238,7 @@ drm_gem_object_release_handle(int id, void *ptr, void *= data) if (obj->funcs->close) obj->funcs->close(obj, file_priv); =20 - drm_gem_remove_prime_handles(obj, file_priv); + drm_prime_remove_buf_handle(&file_priv->prime, id); drm_vma_node_revoke(&obj->vma_node, file_priv); =20 drm_gem_object_handle_put_unlocked(obj); diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h index 1fbbc19f1ac09..7bb98e6a446d0 100644 --- a/drivers/gpu/drm/drm_internal.h +++ b/drivers/gpu/drm/drm_internal.h @@ -74,8 +74,8 @@ int drm_prime_fd_to_handle_ioctl(struct drm_device *dev, = void *data, =20 void drm_prime_init_file_private(struct drm_prime_file_private *prime_fpri= v); void drm_prime_destroy_file_private(struct drm_prime_file_private *prime_f= priv); -void drm_prime_remove_buf_handle_locked(struct drm_prime_file_private *pri= me_fpriv, - struct dma_buf *dma_buf); +void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpri= v, + uint32_t handle); =20 /* drm_drv.c */ struct drm_minor *drm_minor_acquire(unsigned int minor_id); diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c index e3f09f18110c7..bd5366b16381b 100644 --- a/drivers/gpu/drm/drm_prime.c +++ b/drivers/gpu/drm/drm_prime.c @@ -190,29 +190,33 @@ static int drm_prime_lookup_buf_handle(struct drm_pri= me_file_private *prime_fpri return -ENOENT; } =20 -void drm_prime_remove_buf_handle_locked(struct drm_prime_file_private *pri= me_fpriv, - struct dma_buf *dma_buf) +void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpri= v, + uint32_t handle) { struct rb_node *rb; =20 - rb =3D prime_fpriv->dmabufs.rb_node; + mutex_lock(&prime_fpriv->lock); + + rb =3D prime_fpriv->handles.rb_node; while (rb) { struct drm_prime_member *member; =20 - member =3D rb_entry(rb, struct drm_prime_member, dmabuf_rb); - if (member->dma_buf =3D=3D dma_buf) { + member =3D rb_entry(rb, struct drm_prime_member, handle_rb); + if (member->handle =3D=3D handle) { rb_erase(&member->handle_rb, &prime_fpriv->handles); rb_erase(&member->dmabuf_rb, &prime_fpriv->dmabufs); =20 - dma_buf_put(dma_buf); + dma_buf_put(member->dma_buf); kfree(member); - return; - } else if (member->dma_buf < dma_buf) { + break; + } else if (member->handle < handle) { rb =3D rb->rb_right; } else { rb =3D rb->rb_left; } } + + mutex_unlock(&prime_fpriv->lock); } =20 void drm_prime_init_file_private(struct drm_prime_file_private *prime_fpri= v) --=20 2.35.1