diff mbox

drm/radeon: fix bo creation retry path

Message ID 1342131785-12373-1-git-send-email-j.glisse@gmail.com (mailing list archive)
State New, archived
Headers show

Commit Message

Jerome Glisse July 12, 2012, 10:23 p.m. UTC 
From: Jerome Glisse <jglisse@redhat.com>

Retry label was at wrong place in function leading to memory
leak.

Cc: <stable@vger.kernel.org>
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
---
 drivers/gpu/drm/radeon/radeon_object.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Michel Dänzer July 13, 2012, 5:54 a.m. UTC | #1 
On Don, 2012-07-12 at 18:23 -0400, j.glisse@gmail.com wrote: 
> From: Jerome Glisse <jglisse@redhat.com>
> 
> Retry label was at wrong place in function leading to memory
> leak.
> 
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Jerome Glisse <jglisse@redhat.com>
> ---
>  drivers/gpu/drm/radeon/radeon_object.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
> index 6ecb200..f71e472 100644
> --- a/drivers/gpu/drm/radeon/radeon_object.c
> +++ b/drivers/gpu/drm/radeon/radeon_object.c
> @@ -138,7 +138,6 @@ int radeon_bo_create(struct radeon_device *rdev,
>  	acc_size = ttm_bo_dma_acc_size(&rdev->mman.bdev, size,
>  				       sizeof(struct radeon_bo));
>  
> -retry:
>  	bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
>  	if (bo == NULL)
>  		return -ENOMEM;
> @@ -152,6 +151,8 @@ retry:
>  	bo->surface_reg = -1;
>  	INIT_LIST_HEAD(&bo->list);
>  	INIT_LIST_HEAD(&bo->va);
> +
> +retry:
>  	radeon_ttm_placement_from_domain(bo, domain);
>  	/* Kernel allocation are uninterruptible */
>  	down_read(&rdev->pm.mclk_lock);

Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Christian König July 13, 2012, 7:43 a.m. UTC | #2 
On 13.07.2012 00:23, j.glisse@gmail.com wrote:
> From: Jerome Glisse <jglisse@redhat.com>
>
> Retry label was at wrong place in function leading to memory
> leak.
>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
> ---
>   drivers/gpu/drm/radeon/radeon_object.c |    3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
> index 6ecb200..f71e472 100644
> --- a/drivers/gpu/drm/radeon/radeon_object.c
> +++ b/drivers/gpu/drm/radeon/radeon_object.c
> @@ -138,7 +138,6 @@ int radeon_bo_create(struct radeon_device *rdev,
>   	acc_size = ttm_bo_dma_acc_size(&rdev->mman.bdev, size,
>   				       sizeof(struct radeon_bo));
>   
> -retry:
>   	bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
>   	if (bo == NULL)
>   		return -ENOMEM;
> @@ -152,6 +151,8 @@ retry:
>   	bo->surface_reg = -1;
>   	INIT_LIST_HEAD(&bo->list);
>   	INIT_LIST_HEAD(&bo->va);
> +
> +retry:
>   	radeon_ttm_placement_from_domain(bo, domain);
>   	/* Kernel allocation are uninterruptible */
>   	down_read(&rdev->pm.mclk_lock);
Michel Dänzer Aug. 21, 2012, 7:03 a.m. UTC | #3 
On Fre, 2012-07-13 at 07:54 +0200, Michel Dänzer wrote: 
> On Don, 2012-07-12 at 18:23 -0400, j.glisse@gmail.com wrote: 
> > From: Jerome Glisse <jglisse@redhat.com>
> > 
> > Retry label was at wrong place in function leading to memory
> > leak.
> > 
> > Cc: <stable@vger.kernel.org>
> > Signed-off-by: Jerome Glisse <jglisse@redhat.com>
> > ---
> >  drivers/gpu/drm/radeon/radeon_object.c |    3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
> > index 6ecb200..f71e472 100644
> > --- a/drivers/gpu/drm/radeon/radeon_object.c
> > +++ b/drivers/gpu/drm/radeon/radeon_object.c
> > @@ -138,7 +138,6 @@ int radeon_bo_create(struct radeon_device *rdev,
> >  	acc_size = ttm_bo_dma_acc_size(&rdev->mman.bdev, size,
> >  				       sizeof(struct radeon_bo));
> >  
> > -retry:
> >  	bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
> >  	if (bo == NULL)
> >  		return -ENOMEM;
> > @@ -152,6 +151,8 @@ retry:
> >  	bo->surface_reg = -1;
> >  	INIT_LIST_HEAD(&bo->list);
> >  	INIT_LIST_HEAD(&bo->va);
> > +
> > +retry:
> >  	radeon_ttm_placement_from_domain(bo, domain);
> >  	/* Kernel allocation are uninterruptible */
> >  	down_read(&rdev->pm.mclk_lock);
> 
> Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>

Actually, this is wrong: ttm_bo_init() destroys the BO on failure. So
this patch makes the retry path work with freed memory. I see on IRC
that this is causing panics with some piglit tests for several people,
please submit a patch to revert this.

Sorry I didn't remember this when reviewing the patch. :(
Alex Deucher Aug. 21, 2012, 2:15 p.m. UTC | #4 
On Tue, Aug 21, 2012 at 3:03 AM, Michel Dänzer <michel@daenzer.net> wrote:
> On Fre, 2012-07-13 at 07:54 +0200, Michel Dänzer wrote:
>> On Don, 2012-07-12 at 18:23 -0400, j.glisse@gmail.com wrote:
>> > From: Jerome Glisse <jglisse@redhat.com>
>> >
>> > Retry label was at wrong place in function leading to memory
>> > leak.
>> >
>> > Cc: <stable@vger.kernel.org>
>> > Signed-off-by: Jerome Glisse <jglisse@redhat.com>
>> > ---
>> >  drivers/gpu/drm/radeon/radeon_object.c |    3 ++-
>> >  1 file changed, 2 insertions(+), 1 deletion(-)
>> >
>> > diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
>> > index 6ecb200..f71e472 100644
>> > --- a/drivers/gpu/drm/radeon/radeon_object.c
>> > +++ b/drivers/gpu/drm/radeon/radeon_object.c
>> > @@ -138,7 +138,6 @@ int radeon_bo_create(struct radeon_device *rdev,
>> >     acc_size = ttm_bo_dma_acc_size(&rdev->mman.bdev, size,
>> >                                    sizeof(struct radeon_bo));
>> >
>> > -retry:
>> >     bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
>> >     if (bo == NULL)
>> >             return -ENOMEM;
>> > @@ -152,6 +151,8 @@ retry:
>> >     bo->surface_reg = -1;
>> >     INIT_LIST_HEAD(&bo->list);
>> >     INIT_LIST_HEAD(&bo->va);
>> > +
>> > +retry:
>> >     radeon_ttm_placement_from_domain(bo, domain);
>> >     /* Kernel allocation are uninterruptible */
>> >     down_read(&rdev->pm.mclk_lock);
>>
>> Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
>
> Actually, this is wrong: ttm_bo_init() destroys the BO on failure. So
> this patch makes the retry path work with freed memory. I see on IRC
> that this is causing panics with some piglit tests for several people,
> please submit a patch to revert this.
>
> Sorry I didn't remember this when reviewing the patch. :(

Reverted in my -fixes queue.

Alex
diff mbox

Patch

diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 6ecb200..f71e472 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -138,7 +138,6 @@  int radeon_bo_create(struct radeon_device *rdev,
 	acc_size = ttm_bo_dma_acc_size(&rdev->mman.bdev, size,
 				       sizeof(struct radeon_bo));
 
-retry:
 	bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
 	if (bo == NULL)
 		return -ENOMEM;
@@ -152,6 +151,8 @@  retry:
 	bo->surface_reg = -1;
 	INIT_LIST_HEAD(&bo->list);
 	INIT_LIST_HEAD(&bo->va);
+
+retry:
 	radeon_ttm_placement_from_domain(bo, domain);
 	/* Kernel allocation are uninterruptible */
 	down_read(&rdev->pm.mclk_lock);