The first patch just prevents to iterate on a NULL job->bo array during job cleanup. This situation can happen when v3d_lookup_bos() fails to allocate memory for the job->bo array and job->bo_count was already set. The second replace BOs lookup steps in v3d_lookup_bos() with the common code in drm_gem_objects_lookup().
Melissa Wen (2): drm/v3d: cleanup BOs properly when lookup_bos fails drm/v3d: replace obj lookup steps with drm_gem_objects_lookup
drivers/gpu/drm/v3d/v3d_gem.c | 55 ++++------------------------------- 1 file changed, 6 insertions(+), 49 deletions(-)
When v3d_lookup_bos fails to `allocate validated BO pointers`, job->bo_count was already set to args->bo_count, but job->bo points to NULL. In this scenario, we must verify that job->bo is not NULL before iterating on it to proper clean up a job. Also, drm_gem_object_put already checks that the object passed is not NULL, doing the job->bo[i] checker redundant.
Signed-off-by: Melissa Wen mwen@igalia.com --- drivers/gpu/drm/v3d/v3d_gem.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c index 92bc0faee84f..926bfc7e07fb 100644 --- a/drivers/gpu/drm/v3d/v3d_gem.c +++ b/drivers/gpu/drm/v3d/v3d_gem.c @@ -358,11 +358,11 @@ v3d_job_free(struct kref *ref) struct v3d_job *job = container_of(ref, struct v3d_job, refcount); int i;
- for (i = 0; i < job->bo_count; i++) { - if (job->bo[i]) + if (job->bo) { + for (i = 0; i < job->bo_count; i++) drm_gem_object_put(job->bo[i]); + kvfree(job->bo); } - kvfree(job->bo);
dma_fence_put(job->irq_fence); dma_fence_put(job->done_fence);
As v3d_lookup_bos() performs the same steps as drm_gem_objects_lookup(), replace the explicit code in v3d to simply use the DRM function.
Signed-off-by: Melissa Wen mwen@igalia.com --- drivers/gpu/drm/v3d/v3d_gem.c | 49 +++-------------------------------- 1 file changed, 3 insertions(+), 46 deletions(-)
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c index 926bfc7e07fb..738b1080143d 100644 --- a/drivers/gpu/drm/v3d/v3d_gem.c +++ b/drivers/gpu/drm/v3d/v3d_gem.c @@ -294,10 +294,6 @@ v3d_lookup_bos(struct drm_device *dev, u64 bo_handles, u32 bo_count) { - u32 *handles; - int ret = 0; - int i; - job->bo_count = bo_count;
if (!job->bo_count) { @@ -308,48 +304,9 @@ v3d_lookup_bos(struct drm_device *dev, return -EINVAL; }
- job->bo = kvmalloc_array(job->bo_count, - sizeof(struct drm_gem_cma_object *), - GFP_KERNEL | __GFP_ZERO); - if (!job->bo) { - DRM_DEBUG("Failed to allocate validated BO pointers\n"); - return -ENOMEM; - } - - handles = kvmalloc_array(job->bo_count, sizeof(u32), GFP_KERNEL); - if (!handles) { - ret = -ENOMEM; - DRM_DEBUG("Failed to allocate incoming GEM handles\n"); - goto fail; - } - - if (copy_from_user(handles, - (void __user *)(uintptr_t)bo_handles, - job->bo_count * sizeof(u32))) { - ret = -EFAULT; - DRM_DEBUG("Failed to copy in GEM handles\n"); - goto fail; - } - - spin_lock(&file_priv->table_lock); - for (i = 0; i < job->bo_count; i++) { - struct drm_gem_object *bo = idr_find(&file_priv->object_idr, - handles[i]); - if (!bo) { - DRM_DEBUG("Failed to look up GEM BO %d: %d\n", - i, handles[i]); - ret = -ENOENT; - spin_unlock(&file_priv->table_lock); - goto fail; - } - drm_gem_object_get(bo); - job->bo[i] = bo; - } - spin_unlock(&file_priv->table_lock); - -fail: - kvfree(handles); - return ret; + return drm_gem_objects_lookup(file_priv, + (void __user *)(uintptr_t)bo_handles, + job->bo_count, &job->bo); }
static void
dri-devel@lists.freedesktop.org
-
Melissa Wen