Commit a8bb6818 authored by Daniel Vetter's avatar Daniel Vetter

drm/i915: Fix error path leak in fbdev fb allocation

In Jesse's patch to switch the fbdev framebuffer from an embedded
struct to a pointer the kfree in case of an error was missed. Fix this
up by using our own internal fb allocation helper directly instead of
reinventing that wheel.

We need a to_intel_framebuffer cast unfortunately since all the other
callers of _create still look better whith using a drm_framebuffer as
return pointer.

v2: Add an unlocked __intel_framebuffer_create function since our
dev->struct_mutex locking is too much a mess. With ppgtt we even need
it to take a look at the global gtt offset of pinned objects, since
the vma list might chance from underneath us. At least with the
current global gtt lookup functions. Reported by Mika.

Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Reviewed-by: default avatarJesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
parent ef2d633e
...@@ -7690,10 +7690,15 @@ static struct drm_display_mode load_detect_mode = { ...@@ -7690,10 +7690,15 @@ static struct drm_display_mode load_detect_mode = {
704, 832, 0, 480, 489, 491, 520, 0, DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC), 704, 832, 0, 480, 489, 491, 520, 0, DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC),
}; };
static struct drm_framebuffer * static int intel_framebuffer_init(struct drm_device *dev,
intel_framebuffer_create(struct drm_device *dev, struct intel_framebuffer *ifb,
struct drm_mode_fb_cmd2 *mode_cmd, struct drm_mode_fb_cmd2 *mode_cmd,
struct drm_i915_gem_object *obj) struct drm_i915_gem_object *obj);
struct drm_framebuffer *
__intel_framebuffer_create(struct drm_device *dev,
struct drm_mode_fb_cmd2 *mode_cmd,
struct drm_i915_gem_object *obj)
{ {
struct intel_framebuffer *intel_fb; struct intel_framebuffer *intel_fb;
int ret; int ret;
...@@ -7704,12 +7709,7 @@ intel_framebuffer_create(struct drm_device *dev, ...@@ -7704,12 +7709,7 @@ intel_framebuffer_create(struct drm_device *dev,
return ERR_PTR(-ENOMEM); return ERR_PTR(-ENOMEM);
} }
ret = i915_mutex_lock_interruptible(dev);
if (ret)
goto err;
ret = intel_framebuffer_init(dev, intel_fb, mode_cmd, obj); ret = intel_framebuffer_init(dev, intel_fb, mode_cmd, obj);
mutex_unlock(&dev->struct_mutex);
if (ret) if (ret)
goto err; goto err;
...@@ -7721,6 +7721,23 @@ intel_framebuffer_create(struct drm_device *dev, ...@@ -7721,6 +7721,23 @@ intel_framebuffer_create(struct drm_device *dev,
return ERR_PTR(ret); return ERR_PTR(ret);
} }
struct drm_framebuffer *
intel_framebuffer_create(struct drm_device *dev,
struct drm_mode_fb_cmd2 *mode_cmd,
struct drm_i915_gem_object *obj)
{
struct drm_framebuffer *fb;
int ret;
ret = i915_mutex_lock_interruptible(dev);
if (ret)
return ERR_PTR(ret);
fb = __intel_framebuffer_create(dev, mode_cmd, obj);
mutex_unlock(&dev->struct_mutex);
return fb;
}
static u32 static u32
intel_framebuffer_pitch_for_width(int width, int bpp) intel_framebuffer_pitch_for_width(int width, int bpp)
{ {
......
...@@ -681,8 +681,8 @@ int intel_pin_and_fence_fb_obj(struct drm_device *dev, ...@@ -681,8 +681,8 @@ int intel_pin_and_fence_fb_obj(struct drm_device *dev,
struct drm_i915_gem_object *obj, struct drm_i915_gem_object *obj,
struct intel_ring_buffer *pipelined); struct intel_ring_buffer *pipelined);
void intel_unpin_fb_obj(struct drm_i915_gem_object *obj); void intel_unpin_fb_obj(struct drm_i915_gem_object *obj);
int intel_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *
struct intel_framebuffer *ifb, __intel_framebuffer_create(struct drm_device *dev,
struct drm_mode_fb_cmd2 *mode_cmd, struct drm_mode_fb_cmd2 *mode_cmd,
struct drm_i915_gem_object *obj); struct drm_i915_gem_object *obj);
void intel_prepare_page_flip(struct drm_device *dev, int plane); void intel_prepare_page_flip(struct drm_device *dev, int plane);
......
...@@ -62,20 +62,12 @@ static int intelfb_alloc(struct drm_fb_helper *helper, ...@@ -62,20 +62,12 @@ static int intelfb_alloc(struct drm_fb_helper *helper,
{ {
struct intel_fbdev *ifbdev = struct intel_fbdev *ifbdev =
container_of(helper, struct intel_fbdev, helper); container_of(helper, struct intel_fbdev, helper);
struct intel_framebuffer *fb; struct drm_framebuffer *fb;
struct drm_device *dev = helper->dev; struct drm_device *dev = helper->dev;
struct drm_mode_fb_cmd2 mode_cmd = {}; struct drm_mode_fb_cmd2 mode_cmd = {};
struct drm_i915_gem_object *obj; struct drm_i915_gem_object *obj;
int size, ret; int size, ret;
fb = kzalloc(sizeof(*fb), GFP_KERNEL);
if (!fb) {
ret = -ENOMEM;
goto out;
}
ifbdev->fb = fb;
/* we don't do packed 24bpp */ /* we don't do packed 24bpp */
if (sizes->surface_bpp == 24) if (sizes->surface_bpp == 24)
sizes->surface_bpp = 32; sizes->surface_bpp = 32;
...@@ -102,13 +94,17 @@ static int intelfb_alloc(struct drm_fb_helper *helper, ...@@ -102,13 +94,17 @@ static int intelfb_alloc(struct drm_fb_helper *helper,
/* Flush everything out, we'll be doing GTT only from now on */ /* Flush everything out, we'll be doing GTT only from now on */
ret = intel_pin_and_fence_fb_obj(dev, obj, NULL); ret = intel_pin_and_fence_fb_obj(dev, obj, NULL);
if (ret) { if (ret) {
DRM_ERROR("failed to pin fb: %d\n", ret); DRM_ERROR("failed to pin obj: %d\n", ret);
goto out_unref; goto out_unref;
} }
ret = intel_framebuffer_init(dev, ifbdev->fb, &mode_cmd, obj); fb = __intel_framebuffer_create(dev, &mode_cmd, obj);
if (ret) if (IS_ERR(fb)) {
ret = PTR_ERR(fb);
goto out_unpin; goto out_unpin;
}
ifbdev->fb = to_intel_framebuffer(fb);
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment