Commit e7ca0773 authored by Dmitry Baryshkov's avatar Dmitry Baryshkov Committed by Wang Hai
Browse files

drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails 

mainline inclusion
from mainline-v6.11-rc5
commit bfa1a6283be390947d3649c482e5167186a37016
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZV
CVE: CVE-2024-44982

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bfa1a6283be390947d3649c482e5167186a37016



--------------------------------

If the dpu_format_populate_layout() fails, then FB is prepared, but not
cleaned up. This ends up leaking the pin_count on the GEM object and
causes a splat during DRM file closure:

msm_obj->pin_count
WARNING: CPU: 2 PID: 569 at drivers/gpu/drm/msm/msm_gem.c:121 update_lru_locked+0xc4/0xcc
[...]
Call trace:
 update_lru_locked+0xc4/0xcc
 put_pages+0xac/0x100
 msm_gem_free_object+0x138/0x180
 drm_gem_object_free+0x1c/0x30
 drm_gem_object_handle_put_unlocked+0x108/0x10c
 drm_gem_object_release_handle+0x58/0x70
 idr_for_each+0x68/0xec
 drm_gem_release+0x28/0x40
 drm_file_free+0x174/0x234
 drm_release+0xb0/0x160
 __fput+0xc0/0x2c8
 __fput_sync+0x50/0x5c
 __arm64_sys_close+0x38/0x7c
 invoke_syscall+0x48/0x118
 el0_svc_common.constprop.0+0x40/0xe0
 do_el0_svc+0x1c/0x28
 el0_svc+0x4c/0x120
 el0t_64_sync_handler+0x100/0x12c
 el0t_64_sync+0x190/0x194
irq event stamp: 129818
hardirqs last  enabled at (129817): [<ffffa5f6d953fcc0>] console_unlock+0x118/0x124
hardirqs last disabled at (129818): [<ffffa5f6da7dcf04>] el1_dbg+0x24/0x8c
softirqs last  enabled at (129808): [<ffffa5f6d94afc18>] handle_softirqs+0x4c8/0x4e8
softirqs last disabled at (129785): [<ffffa5f6d94105e4>] __do_softirq+0x14/0x20

Fixes: 25fdd593 ("drm/msm: Add SDM845 DPU support")
Signed-off-by: default avatarDmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: default avatarAbhinav Kumar <quic_abhinavk@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/600714/
Link: https://lore.kernel.org/r/20240625-dpu-mode-config-width-v5-1-501d984d634f@linaro.org


Signed-off-by: default avatarAbhinav Kumar <quic_abhinavk@quicinc.com>

Conflicts:
	drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
[Conflict due to commit 9e4dde28 ("drm/msm: Avoid dirtyfb stalls on
 video mode displays (v2)") didn't merge.]
Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
parent 6048262d

drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c

+2 −0
Original line number Diff line number Diff line
@@ -891,6 +891,8 @@ static int dpu_plane_prepare_fb(struct drm_plane *plane, 
			new_state->fb, &layout);

	if (ret) {

		DPU_ERROR_PLANE(pdpu, "failed to get format layout, %d\n", ret);

		if (pstate->aspace)

			msm_framebuffer_cleanup(new_state->fb, pstate->aspace);

		return ret;

	}