torvalds/linux
torvalds/linux
2
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-04 20:19:47 +08:00
Code

drm/msm: Fix submit error-path leaks

Browse Source 
For errors after msm_submitqueue_get(), we need to drop the submitqueue
reference.  Additionally after get_unused_fd() we need to drop the fd.
The ordering for dropping the queue lock and put_unused_fd() is not
important, so just move this all into out_post_unlock.

v2: Only drop queue ref if submit doesn't take it
v3: Fix unitialized submit ref in error path
v4: IS_ERR_OR_NULL()

Reported-by: pinkperfect2021@gmail.com
Fixes: f0de40a131 drm/msm: ("Reorder lock vs submit alloc")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Patchwork: https://patchwork.freedesktop.org/patch/536073/
Link: https://lore.kernel.org/r/20230509203041.440619-1-robdclark@gmail.com
This commit is contained in:
Rob Clark 2023-05-09 13:30:41 -07:00
parent db40d2928d
commit 68dc6c2d5e
1 changed files with 18 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
drivers/gpu/drm/msm/msm_gem_submit.c
View File

@ -722,7 +722,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
struct msm_drm_private *priv = dev->dev_private; struct msm_drm_private *priv = dev->dev_private;
struct drm_msm_gem_submit *args = data; struct drm_msm_gem_submit *args = data;
struct msm_file_private *ctx = file->driver_priv; struct msm_file_private *ctx = file->driver_priv;
struct msm_gem_submit *submit; struct msm_gem_submit *submit = NULL;
struct msm_gpu *gpu = priv->gpu; struct msm_gpu *gpu = priv->gpu;
struct msm_gpu_submitqueue *queue; struct msm_gpu_submitqueue *queue;
struct msm_ringbuffer *ring; struct msm_ringbuffer *ring;
@ -769,13 +769,15 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
out_fence_fd = get_unused_fd_flags(O_CLOEXEC); out_fence_fd = get_unused_fd_flags(O_CLOEXEC);
if (out_fence_fd < 0) { if (out_fence_fd < 0) {
ret = out_fence_fd; ret = out_fence_fd;
return ret; goto out_post_unlock;
} }
} }
submit = submit_create(dev, gpu, queue, args->nr_bos, args->nr_cmds); submit = submit_create(dev, gpu, queue, args->nr_bos, args->nr_cmds);
if (IS_ERR(submit)) if (IS_ERR(submit)) {
return PTR_ERR(submit); ret = PTR_ERR(submit);
goto out_post_unlock;
}
trace_msm_gpu_submit(pid_nr(submit->pid), ring->id, submit->ident, trace_msm_gpu_submit(pid_nr(submit->pid), ring->id, submit->ident,
args->nr_bos, args->nr_cmds); args->nr_bos, args->nr_cmds);
@ -962,11 +964,20 @@ out:
if (has_ww_ticket) if (has_ww_ticket)
ww_acquire_fini(&submit->ticket); ww_acquire_fini(&submit->ticket);
out_unlock: out_unlock:
if (ret && (out_fence_fd >= 0))
put_unused_fd(out_fence_fd);
mutex_unlock(&queue->lock); mutex_unlock(&queue->lock);
out_post_unlock: out_post_unlock:
msm_gem_submit_put(submit); if (ret && (out_fence_fd >= 0))
put_unused_fd(out_fence_fd);
if (!IS_ERR_OR_NULL(submit)) {
msm_gem_submit_put(submit);
} else {
/*
* If the submit hasn't yet taken ownership of the queue
* then we need to drop the reference ourself:
*/
msm_submitqueue_put(queue);
}
if (!IS_ERR_OR_NULL(post_deps)) { if (!IS_ERR_OR_NULL(post_deps)) {
for (i = 0; i < args->nr_out_syncobjs; ++i) { for (i = 0; i < args->nr_out_syncobjs; ++i) {
kfree(post_deps[i].chain); kfree(post_deps[i].chain);