| Message ID | 20230306100722.28485-3-johan+linaro@kernel.org (mailing list archive) |
|---|---|
| State | Not Applicable |
| Headers | show |
| Series | drm/msm: fix bind error handling | expand |
On 06/03/2023 12:07, Johan Hovold wrote: > This reverts commit 8636500300a01740d92b345c680b036b94555b1b. > > A recent commit tried to address a drm device leak in the early > msm_drm_uninit() error paths but ended up making things worse. > > Specifically, it moved the drm device reference put in msm_drm_uninit() > to msm_drm_init() which means that the drm would now be leaked on normal > unbind. > > For reasons that were never spelled out, it also added kms NULL pointer > checks to a couple of helper functions that had nothing to do with the > paths modified by the patch. > > Instead of trying to salvage this incrementally, let's revert the bad > commit so that clean and backportable fixes can be added in its place. > > Fixes: 8636500300a0 ("drm/msm: Fix failure paths in msm_drm_init()") > Cc: Akhil P Oommen <quic_akhilpo@quicinc.com> > Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Ok, let's do it this way Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> > --- > drivers/gpu/drm/msm/disp/msm_disp_snapshot.c | 3 --- > drivers/gpu/drm/msm/msm_drv.c | 11 ++++------- > 2 files changed, 4 insertions(+), 10 deletions(-) > > diff --git a/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c b/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c > index b73031cd48e4..e75b97127c0d 100644 > --- a/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c > +++ b/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c > @@ -129,9 +129,6 @@ void msm_disp_snapshot_destroy(struct drm_device *drm_dev) > } > > priv = drm_dev->dev_private; > - if (!priv->kms) > - return; > - > kms = priv->kms; > > if (kms->dump_worker) > diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c > index b7f5a78eadd4..9ded384acba4 100644 > --- a/drivers/gpu/drm/msm/msm_drv.c > +++ b/drivers/gpu/drm/msm/msm_drv.c > @@ -150,9 +150,6 @@ static void msm_irq_uninstall(struct drm_device *dev) > struct msm_drm_private *priv = dev->dev_private; > struct msm_kms *kms = priv->kms; > > - if (!priv->kms) > - return; > - > kms->funcs->irq_uninstall(kms); > if (kms->irq_requested) > free_irq(kms->irq, dev); > @@ -270,6 +267,8 @@ static int msm_drm_uninit(struct device *dev) > component_unbind_all(dev, ddev); > > ddev->dev_private = NULL; > + drm_dev_put(ddev); > + > destroy_workqueue(priv->wq); > > return 0; > @@ -442,12 +441,12 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv) > > ret = msm_init_vram(ddev); > if (ret) > - goto err_drm_dev_put; > + return ret; > > /* Bind all our sub-components: */ > ret = component_bind_all(dev, ddev); > if (ret) > - goto err_drm_dev_put; > + return ret; > > dma_set_max_seg_size(dev, UINT_MAX); > > @@ -542,8 +541,6 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv) > > err_msm_uninit: > msm_drm_uninit(dev); > -err_drm_dev_put: > - drm_dev_put(ddev); > return ret; > } >
diff --git a/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c b/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c index b73031cd48e4..e75b97127c0d 100644 --- a/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c +++ b/drivers/gpu/drm/msm/disp/msm_disp_snapshot.c @@ -129,9 +129,6 @@ void msm_disp_snapshot_destroy(struct drm_device *drm_dev) } priv = drm_dev->dev_private; - if (!priv->kms) - return; - kms = priv->kms; if (kms->dump_worker) diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c index b7f5a78eadd4..9ded384acba4 100644 --- a/drivers/gpu/drm/msm/msm_drv.c +++ b/drivers/gpu/drm/msm/msm_drv.c @@ -150,9 +150,6 @@ static void msm_irq_uninstall(struct drm_device *dev) struct msm_drm_private *priv = dev->dev_private; struct msm_kms *kms = priv->kms; - if (!priv->kms) - return; - kms->funcs->irq_uninstall(kms); if (kms->irq_requested) free_irq(kms->irq, dev); @@ -270,6 +267,8 @@ static int msm_drm_uninit(struct device *dev) component_unbind_all(dev, ddev); ddev->dev_private = NULL; + drm_dev_put(ddev); + destroy_workqueue(priv->wq); return 0; @@ -442,12 +441,12 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv) ret = msm_init_vram(ddev); if (ret) - goto err_drm_dev_put; + return ret; /* Bind all our sub-components: */ ret = component_bind_all(dev, ddev); if (ret) - goto err_drm_dev_put; + return ret; dma_set_max_seg_size(dev, UINT_MAX); @@ -542,8 +541,6 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv) err_msm_uninit: msm_drm_uninit(dev); -err_drm_dev_put: - drm_dev_put(ddev); return ret; }
This reverts commit 8636500300a01740d92b345c680b036b94555b1b. A recent commit tried to address a drm device leak in the early msm_drm_uninit() error paths but ended up making things worse. Specifically, it moved the drm device reference put in msm_drm_uninit() to msm_drm_init() which means that the drm would now be leaked on normal unbind. For reasons that were never spelled out, it also added kms NULL pointer checks to a couple of helper functions that had nothing to do with the paths modified by the patch. Instead of trying to salvage this incrementally, let's revert the bad commit so that clean and backportable fixes can be added in its place. Fixes: 8636500300a0 ("drm/msm: Fix failure paths in msm_drm_init()") Cc: Akhil P Oommen <quic_akhilpo@quicinc.com> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> --- drivers/gpu/drm/msm/disp/msm_disp_snapshot.c | 3 --- drivers/gpu/drm/msm/msm_drv.c | 11 ++++------- 2 files changed, 4 insertions(+), 10 deletions(-)