From e93be638c6cbe21a43b88a2acf620558c8ae4cc2 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 9 Feb 2017 19:07:37 +0000 Subject: [PATCH] Fix OOPSes in vc4 (Raspberry Pi) --- ...to-cache-a-partially-constructed-BO..patch | 42 +++++++++++++++++++ kernel.spec | 8 +++- 2 files changed, 49 insertions(+), 1 deletion(-) create mode 100644 drm-vc4-Fix-OOPSes-from-trying-to-cache-a-partially-constructed-BO..patch diff --git a/drm-vc4-Fix-OOPSes-from-trying-to-cache-a-partially-constructed-BO..patch b/drm-vc4-Fix-OOPSes-from-trying-to-cache-a-partially-constructed-BO..patch new file mode 100644 index 000000000..70a528253 --- /dev/null +++ b/drm-vc4-Fix-OOPSes-from-trying-to-cache-a-partially-constructed-BO..patch @@ -0,0 +1,42 @@ +From patchwork Thu Feb 9 18:16:00 2017 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 7bit +Subject: drm/vc4: Fix OOPSes from trying to cache a partially constructed BO. +From: Eric Anholt +X-Patchwork-Id: 138087 +Message-Id: <20170209181600.24048-1-eric@anholt.net> +To: dri-devel@lists.freedesktop.org +Cc: linux-kernel@vger.kernel.org, pbrobinson@gmail.com +Date: Thu, 9 Feb 2017 10:16:00 -0800 + +If a CMA allocation failed, the partially constructed BO would be +unreferenced through the normal path, and we might choose to put it in +the BO cache. If we then reused it before it expired from the cache, +the kernel would OOPS. + +Signed-off-by: Eric Anholt +Fixes: c826a6e10644 ("drm/vc4: Add a BO cache.") +--- + drivers/gpu/drm/vc4/vc4_bo.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c +index 5ec14f25625d..fd83a2807656 100644 +--- a/drivers/gpu/drm/vc4/vc4_bo.c ++++ b/drivers/gpu/drm/vc4/vc4_bo.c +@@ -314,6 +314,14 @@ void vc4_free_object(struct drm_gem_object *gem_bo) + goto out; + } + ++ /* If this object was partially constructed but CMA allocation ++ * had failed, just free it. ++ */ ++ if (!bo->base.vaddr) { ++ vc4_bo_destroy(bo); ++ goto out; ++ } ++ + cache_list = vc4_get_cache_list_for_size(dev, gem_bo->size); + if (!cache_list) { + vc4_bo_destroy(bo); diff --git a/kernel.spec b/kernel.spec index 17e1ba51d..aede923fb 100644 --- a/kernel.spec +++ b/kernel.spec @@ -527,8 +527,11 @@ Patch431: bcm283x-mmc-imp-speed.patch Patch432: bcm283x-VEC.patch +# http://www.spinics.net/lists/dri-devel/msg132235.html +Patch433: drm-vc4-Fix-OOPSes-from-trying-to-cache-a-partially-constructed-BO..patch + # http://www.spinics.net/lists/arm-kernel/msg552554.html -Patch434: arm-imx6-hummingboard2.patch +Patch438: arm-imx6-hummingboard2.patch Patch460: lib-cpumask-Make-CPUMASK_OFFSTACK-usable-without-deb.patch @@ -2169,6 +2172,9 @@ fi # # %changelog +* Thu Feb 9 2017 Peter Robinson +- Fix OOPSes in vc4 (Raspberry Pi) + * Wed Feb 08 2017 Justin M. Forbes - 4.10.0-0.rc7.git2.1 - Linux v4.10-rc7-65-g926af627