From patchwork Tue Feb 7 06:09:35 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: yao mark X-Patchwork-Id: 9559269 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5729060236 for ; Tue, 7 Feb 2017 06:29:29 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 46F0628068 for ; Tue, 7 Feb 2017 06:29:29 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3B07926E4C; Tue, 7 Feb 2017 06:29:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00 autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [65.50.211.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id E651826E4C for ; Tue, 7 Feb 2017 06:29:28 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.87 #1 (Red Hat Linux)) id 1cazHM-0003rw-36; Tue, 07 Feb 2017 06:29:28 +0000 Received: from regular1.263xmail.com ([211.150.99.130]) by bombadil.infradead.org with esmtps (Exim 4.87 #1 (Red Hat Linux)) id 1cayyf-00038K-RV; Tue, 07 Feb 2017 06:10:15 +0000 Received: from mark.yao?rock-chips.com (unknown [192.168.167.157]) by regular1.263xmail.com (Postfix) with ESMTP id 0D7FDB06B; Tue, 7 Feb 2017 14:09:44 +0800 (CST) X-263anti-spam: KSV:0; X-MAIL-GRAY: 0 X-MAIL-DELIVERY: 1 X-KSVirus-check: 0 X-ABS-CHECKED: 4 Received: from yaozq-pc.lan (localhost [127.0.0.1]) by smtp.263.net (Postfix) with ESMTP id 2AA4D3CD; Tue, 7 Feb 2017 14:09:43 +0800 (CST) X-RL-SENDER: mark.yao@rock-chips.com X-FST-TO: airlied@linux.ie X-SENDER-IP: 58.22.7.114 X-LOGIN-NAME: mark.yao@rock-chips.com X-UNIQUE-TAG: <5d0623acf7bb55466eba85fbc3ac174a> X-ATTACHMENT-NUM: 0 X-SENDER: yzq@rock-chips.com X-DNS-TYPE: 0 Received: from unknown (unknown [58.22.7.114]) by smtp.263.net (Postfix) whith SMTP id 27530DHFJEN; Tue, 07 Feb 2017 14:09:44 +0800 (CST) From: Mark Yao To: David Airlie , Heiko Stuebner , dri-devel@lists.freedesktop.org, linux-arm-kernel@lists.infradead.org, linux-rockchip@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 3/4] drm/rockchip: gem: add mutex lock for drm mm Date: Tue, 7 Feb 2017 14:09:35 +0800 Message-Id: <1486447776-30543-4-git-send-email-mark.yao@rock-chips.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1486447776-30543-1-git-send-email-mark.yao@rock-chips.com> References: <1486447776-30543-1-git-send-email-mark.yao@rock-chips.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20170206_221010_434813_7D990F2C X-CRM114-Status: UNSURE ( 9.15 ) X-CRM114-Notice: Please train this message. X-BeenThere: linux-rockchip@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Upstream kernel work for Rockchip platforms List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mark Yao MIME-Version: 1.0 Sender: "Linux-rockchip" Errors-To: linux-rockchip-bounces+patchwork-linux-rockchip=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP drm_mm_insert_node_generic and drm_mm_remove_node may access same resource with list ops, it's not threads safe, so protect this context with mutex lock. Fix bug: [49451.856244] ================================================================== [49451.856350] BUG: KASAN: wild-memory-access on address dead000000000108 [49451.856379] Write of size 8 by task Binder:218_4/683 [49451.856417] CPU: 2 PID: 683 Comm: Binder:218_4 Not tainted 4.4.36 #62 [49451.856443] Hardware name: Rockchip RK3399 Excavator Board edp (Android) (DT) [49451.856469] Call trace: [49451.856519] [] dump_backtrace+0x0/0x230 [49451.856556] [] show_stack+0x14/0x1c [49451.856592] [] dump_stack+0xa0/0xc8 [49451.856633] [] kasan_report+0x110/0x4dc [49451.856670] [] __asan_store8+0x24/0x7c [49451.856715] [] drm_mm_insert_node_generic+0x2dc/0x464 [49451.856760] [] rockchip_gem_iommu_map+0x60/0x158 [49451.856794] [] rockchip_gem_create_object+0x278/0x488 [49451.856827] [] rockchip_gem_create_with_handle+0x24/0x10c [49451.856862] [] rockchip_gem_create_ioctl+0x3c/0x50 [49451.856896] [] drm_ioctl+0x354/0x52c [49451.856939] [] do_vfs_ioctl+0x670/0x78c [49451.856976] [] SyS_ioctl+0x60/0x88 [49451.857009] [] el0_svc_naked+0x24/0x28 Change-Id: I2ea377aa9ca24f70c59e2d86f2a6ad5ccb9c0891 Signed-off-by: Mark Yao --- drivers/gpu/drm/rockchip/rockchip_drm_drv.c | 1 + drivers/gpu/drm/rockchip/rockchip_drm_drv.h | 2 ++ drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 9 +++++++++ 3 files changed, 12 insertions(+) diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c index 7a610e9..b360e62 100644 --- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c +++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c @@ -146,6 +146,7 @@ static int rockchip_drm_init_iommu(struct drm_device *drm_dev) DRM_DEBUG("IOMMU context initialized (aperture: %#llx-%#llx)\n", start, end); drm_mm_init(&private->mm, start, end - start + 1); + mutex_init(&private->mm_lock); return 0; } diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.h b/drivers/gpu/drm/rockchip/rockchip_drm_drv.h index 7c123d9..adc3930 100644 --- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.h +++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.h @@ -62,6 +62,8 @@ struct rockchip_drm_private { const struct rockchip_crtc_funcs *crtc_funcs[ROCKCHIP_MAX_CRTC]; struct drm_atomic_state *state; struct iommu_domain *domain; + /* protect drm_mm on multi-threads */ + struct mutex mm_lock; struct drm_mm mm; struct list_head psr_list; spinlock_t psr_list_lock; diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c index 5209392..8d27965 100644 --- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c @@ -28,9 +28,13 @@ static int rockchip_gem_iommu_map(struct rockchip_gem_object *rk_obj) int prot = IOMMU_READ | IOMMU_WRITE; ssize_t ret; + mutex_lock(&private->mm_lock); + ret = drm_mm_insert_node_generic(&private->mm, &rk_obj->mm, rk_obj->base.size, PAGE_SIZE, 0, 0); + + mutex_unlock(&private->mm_lock); if (ret < 0) { DRM_ERROR("out of I/O virtual memory: %zd\n", ret); return ret; @@ -61,8 +65,13 @@ static int rockchip_gem_iommu_unmap(struct rockchip_gem_object *rk_obj) struct rockchip_drm_private *private = drm->dev_private; iommu_unmap(private->domain, rk_obj->dma_addr, rk_obj->size); + + mutex_lock(&private->mm_lock); + drm_mm_remove_node(&rk_obj->mm); + mutex_unlock(&private->mm_lock); + return 0; }