Commit 06f7f57e authored by Philip Yang's avatar Philip Yang Committed by Alex Deucher

drm/amdgpu: user pages array memory leak fix

user_pages array should always be freed after validation regardless if
user pages are changed after bo is created because with HMM change parse
bo always allocate user pages array to get user pages for userptr bo.

v2: remove unused local variable and amend commit

v3: add back get user pages in gem_userptr_ioctl, to detect application
bug where an userptr VMA is not ananymous memory and reject it.

Bugzilla: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1844962Signed-off-by: default avatarPhilip Yang <Philip.Yang@amd.com>
Tested-by: default avatarJoe Barnett <thejoe@gmail.com>
Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Reviewed-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 7bbdbe40
...@@ -474,7 +474,6 @@ static int amdgpu_cs_list_validate(struct amdgpu_cs_parser *p, ...@@ -474,7 +474,6 @@ static int amdgpu_cs_list_validate(struct amdgpu_cs_parser *p,
list_for_each_entry(lobj, validated, tv.head) { list_for_each_entry(lobj, validated, tv.head) {
struct amdgpu_bo *bo = ttm_to_amdgpu_bo(lobj->tv.bo); struct amdgpu_bo *bo = ttm_to_amdgpu_bo(lobj->tv.bo);
bool binding_userptr = false;
struct mm_struct *usermm; struct mm_struct *usermm;
usermm = amdgpu_ttm_tt_get_usermm(bo->tbo.ttm); usermm = amdgpu_ttm_tt_get_usermm(bo->tbo.ttm);
...@@ -491,18 +490,15 @@ static int amdgpu_cs_list_validate(struct amdgpu_cs_parser *p, ...@@ -491,18 +490,15 @@ static int amdgpu_cs_list_validate(struct amdgpu_cs_parser *p,
amdgpu_ttm_tt_set_user_pages(bo->tbo.ttm, amdgpu_ttm_tt_set_user_pages(bo->tbo.ttm,
lobj->user_pages); lobj->user_pages);
binding_userptr = true;
} }
r = amdgpu_cs_validate(p, bo); r = amdgpu_cs_validate(p, bo);
if (r) if (r)
return r; return r;
if (binding_userptr) {
kvfree(lobj->user_pages); kvfree(lobj->user_pages);
lobj->user_pages = NULL; lobj->user_pages = NULL;
} }
}
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment