[PATCH] drivers/gpu/drm/ttm/ttm_page_allo.c: adjust ttm pages refcount fix the bug: Feb 6 17:13:13 aaa-PC kernel: [ 466.271034] BUG: Bad page state in process blur_image pfn:7aee2 Feb 6 17:13:13 aaa-PC kernel: [ 466.271037] page:980000025fca4170 count:0 mapcount:0 mapping:980000025a0dca60 index:0x0 Feb 6 17:13:13 aaa-PC kernel: [ 466.271039] flags: 0x1e01fff000000() Feb 6 17:13:13 aaa-PC kernel: [ 466.271042] raw: 0001e01fff000000 0000000000000100 0000000000000200 980000025a0dca60 Feb 6 17:13:13 aaa-PC kern
Signed-off-by: songqiang songqiang@uniontech.com --- drivers/gpu/drm/ttm/ttm_page_alloc.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c index 14660f723f71..f3698f0ad4d7 100644 --- a/drivers/gpu/drm/ttm/ttm_page_alloc.c +++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c @@ -736,8 +736,16 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags, if (++p != pages[i + j]) break;
- if (j == HPAGE_PMD_NR) + if (j == HPAGE_PMD_NR) { order = HPAGE_PMD_ORDER; + for (j = 1; j < HPAGE_PMD_NR; ++j) + page_ref_dec(pages[i+j]); + } } #endif
@@ -868,10 +876,12 @@ static int ttm_get_pages(struct page **pages, unsigned npages, int flags, p = alloc_pages(huge_flags, HPAGE_PMD_ORDER); if (!p) break; - - for (j = 0; j < HPAGE_PMD_NR; ++j) + for (j = 0; j < HPAGE_PMD_NR; ++j) { pages[i++] = p++; - + if (j > 0) + page_ref_inc(pages[i-1]); + } npages -= HPAGE_PMD_NR; } }
On Wed, Apr 07, 2021 at 09:27:46AM +0800, songqiang wrote:
Please add the description in the commit message and subject.
Thanks, Ray
Signed-off-by: songqiang songqiang@uniontech.com
drivers/gpu/drm/ttm/ttm_page_alloc.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c index 14660f723f71..f3698f0ad4d7 100644 --- a/drivers/gpu/drm/ttm/ttm_page_alloc.c +++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c @@ -736,8 +736,16 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags, if (++p != pages[i + j]) break;
if (j == HPAGE_PMD_NR)
if (j == HPAGE_PMD_NR) { order = HPAGE_PMD_ORDER;for (j = 1; j < HPAGE_PMD_NR; ++j)page_ref_dec(pages[i+j]);} }#endif
@@ -868,10 +876,12 @@ static int ttm_get_pages(struct page **pages, unsigned npages, int flags, p = alloc_pages(huge_flags, HPAGE_PMD_ORDER); if (!p) break;
for (j = 0; j < HPAGE_PMD_NR; ++j)
for (j = 0; j < HPAGE_PMD_NR; ++j) { pages[i++] = p++;
if (j > 0)page_ref_inc(pages[i-1]);} npages -= HPAGE_PMD_NR; }
dri-devel mailing list dri-devel@lists.freedesktop.org https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.free...
Thanks Ray for pointing this out. Looks like the mail ended up in my spam folder otherwise.
Apart from that this patch is a really really big NAK. I can't count how often I had to reject stuff like this!
Using the page reference for TTM pages is illegal and can lead to struct page corruption.
Can you please describe why you need that?
Regards, Christian.
Am 07.04.21 um 10:25 schrieb Huang Rui:
On Wed, Apr 07, 2021 at 09:27:46AM +0800, songqiang wrote:
Please add the description in the commit message and subject.
Thanks, Ray
Signed-off-by: songqiang songqiang@uniontech.com
drivers/gpu/drm/ttm/ttm_page_alloc.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c index 14660f723f71..f3698f0ad4d7 100644 --- a/drivers/gpu/drm/ttm/ttm_page_alloc.c +++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c @@ -736,8 +736,16 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags, if (++p != pages[i + j]) break;
if (j == HPAGE_PMD_NR)
if (j == HPAGE_PMD_NR) { order = HPAGE_PMD_ORDER;for (j = 1; j < HPAGE_PMD_NR; ++j)page_ref_dec(pages[i+j]);} }@@ -868,10 +876,12 @@ static int ttm_get_pages(struct page **pages, unsigned npages, int flags, p = alloc_pages(huge_flags, HPAGE_PMD_ORDER); if (!p) break;
for (j = 0; j < HPAGE_PMD_NR; ++j)
for (j = 0; j < HPAGE_PMD_NR; ++j) { pages[i++] = p++;
if (j > 0)page_ref_inc(pages[i-1]);} npages -= HPAGE_PMD_NR; }
dri-devel mailing list dri-devel@lists.freedesktop.org https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.free...
dri-devel@lists.freedesktop.org
-
Christian König -
Huang Rui -
songqiang