kernel/linux.git/drivers/gpu/drm/ttm, branch v5.10.89

drm/ttm: stop calling tt_swapin in vm_access

2021-11-18T13:04:04+00:00

[ Upstream commit f5d28856b89baab4232a9f841e565763fcebcdf9 ] In commit: commit 09ac4fcb3f255e9225967c75f5893325c116cdbe Author: Felix Kuehling Date: Thu Jul 13 17:01:16 2017 -0400 drm/ttm: Implement vm_operations_struct.access v2 we added the vm_access hook, where we also directly call tt_swapin for some reason. If something is swapped-out then the ttm_tt must also be unpopulated, and since access_kmap should also call tt_populate, if needed, then swapping-in will already be handled there. If anything, calling tt_swapin directly here would likely always fail since the tt->pages won't yet be populated, or worse since the tt->pages array is never actually cleared in unpopulate this might lead to a nasty uaf. Fixes: 09ac4fcb3f25 ("drm/ttm: Implement vm_operations_struct.access v2") Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Christian König Reviewed-by: Thomas Hellström Reviewed-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20210927114114.152310-1-matthew.auld@intel.com Signed-off-by: Christian König Signed-off-by: Sasha Levin

Revert "drm/ttm: fix memleak in ttm_transfered_destroy"

2021-11-06T13:10:09+00:00

This reverts commit c21b4002214c1c7e7b627b9b53375612f7aab6db which is commit 0db55f9a1bafbe3dac750ea669de9134922389b5 upstream. Seems that the older kernels can not handle this fix because, to quote Christian: The problem is this memory leak could potentially happen with 5.10 as wel, just much much much less likely. But my guess is that 5.10 is so buggy that when the leak does NOT happen we double free and obviously causing a crash. So it needs to be reverted. Link: https://lore.kernel.org/r/1a1cc125-9314-f569-a6c4-40fc4509a377@amd.com Cc: Christian König Cc: Erhard F. Cc: Erhard F. Cc: Huang Rui Signed-off-by: Greg Kroah-Hartman

drm/ttm: fix memleak in ttm_transfered_destroy

2021-11-02T18:48:20+00:00

commit 0db55f9a1bafbe3dac750ea669de9134922389b5 upstream. We need to cleanup the fences for ghost objects as well. Signed-off-by: Christian König Reported-by: Erhard F. Tested-by: Erhard F. Reviewed-by: Huang Rui Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214029 Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214447 CC: Link: https://patchwork.freedesktop.org/patch/msgid/20211020173211.2247-1-christian.koenig@amd.com Signed-off-by: Greg Kroah-Hartman

drm/ttm: add a check against null pointer dereference

2021-07-31T06:16:12+00:00

[ Upstream commit 9e5c772954406829e928dbe59891d08938ead04b ] When calling ttm_range_man_fini(), 'man' may be uninitialized, which may cause a null pointer dereference bug. Fix this by checking if it is a null pointer. This log reveals it: [ 7.902580 ] BUG: kernel NULL pointer dereference, address: 0000000000000058 [ 7.905721 ] RIP: 0010:ttm_range_man_fini+0x40/0x160 [ 7.911826 ] Call Trace: [ 7.911826 ] radeon_ttm_fini+0x167/0x210 [ 7.911826 ] radeon_bo_fini+0x15/0x40 [ 7.913767 ] rs400_fini+0x55/0x80 [ 7.914358 ] radeon_device_fini+0x3c/0x140 [ 7.914358 ] radeon_driver_unload_kms+0x5c/0xe0 [ 7.914358 ] radeon_driver_load_kms+0x13a/0x200 [ 7.914358 ] ? radeon_driver_unload_kms+0xe0/0xe0 [ 7.914358 ] drm_dev_register+0x1db/0x290 [ 7.914358 ] radeon_pci_probe+0x16a/0x230 [ 7.914358 ] local_pci_probe+0x4a/0xb0 Signed-off-by: Zheyu Ma Reviewed-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/1626274459-8148-1-git-send-email-zheyuma97@gmail.com Signed-off-by: Christian König Signed-off-by: Sasha Levin

drm/ttm: fix eviction valuable range check.

2020-10-20T20:59:07+00:00

This was adding size to start, but pfn and start are in pages, so it should be using num_pages. Not sure this fixes anything in the real world, just noticed it during refactoring. Signed-off-by: Dave Airlie Reviewed-by: Christian König Cc: stable@vger.kernel.org Link: https://patchwork.freedesktop.org/patch/msgid/20201019222257.1684769-2-airlied@gmail.com

drm/ttm: update kernel-doc line comments

2020-09-21T09:20:13+00:00

Update kernel-doc line comments to fix warnings reported by make W=1. drivers/gpu/drm/ttm/ttm_memory.c:271: warning: Function parameter or member 'glob' not described in 'ttm_shrink' drivers/gpu/drm/ttm/ttm_memory.c:271: warning: Function parameter or member 'from_wq' not described in 'ttm_shrink' drivers/gpu/drm/ttm/ttm_memory.c:271: warning: Function parameter or member 'extra' not described in 'ttm_shrink' drivers/gpu/drm/ttm/ttm_memory.c:271: warning: Function parameter or member 'ctx' not described in 'ttm_shrink' Signed-off-by: Tian Tao Reviewed-by: Christian König Acked-by: Huang Rui Link: https://patchwork.freedesktop.org/patch/391317/ Signed-off-by: Christian König

drm/ttm: drop evicted from ttm_bo.

2020-09-17T20:23:38+00:00

This was unused. Signed-off-by: Dave Airlie Reviewed-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20200917064132.148521-3-airlied@gmail.com

drm/ttm: drop special pipeline accel cleanup function.

2020-09-17T20:23:06+00:00

The two accel cleanup paths were mostly the same once refactored. Just pass a bool to say if the evictions are to be pipelined. Signed-off-by: Dave Airlie Reviewed-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20200917064132.148521-2-airlied@gmail.com

drm/ttm: make common function for wait/free node path.

2020-09-17T20:21:29+00:00

The pipeline and accel cleansups has similiar paths here. Signed-off-by: Dave Airlie Reviewed-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20200917043040.146575-8-airlied@gmail.com

drm/ttm: move ghost object creation to a common function

2020-09-17T20:21:25+00:00

Both accel cleanup and pipeline move had the same code, make a single function for it. Signed-off-by: Dave Airlie Reviewed-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20200917043040.146575-7-airlied@gmail.com