Host1x implements a mechanism to cache buffer object mappings to allow
skipping costly map/unmap cycles for buffers that where that commonly
happens (buffers used with display). The intention was that once the
user frees the buffer, the cache mapping also goes away.
However, the cached mapping was also keeping a refcount on the buffer,
so the code freeing the buffer -- and releasing the cached mapping --
would never run, hence leaking any buffer used with the cache.
Fix by making cache's reference to the buffer weak.
Merging notes:
The change to the crypto driver is safe to merge independently. The
driver keeps its own refcount regardless so the buffer won't get freed
incorrectly.
---
Mikko Perttunen (2):
gpu: host1x: Allow entries in BO caches to be freed
crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin
drivers/crypto/tegra/tegra-se-main.c | 3 +-
drivers/gpu/drm/tegra/gem.c | 13 ++------
drivers/gpu/drm/tegra/submit.c | 3 +-
drivers/gpu/host1x/bus.c | 60 +++++++++++++++++++++++++++++++++++-
include/linux/host1x.h | 7 +++++
5 files changed, 70 insertions(+), 16 deletions(-)
---
base-commit: 028ef9c96e96197026887c0f092424679298aae8
change-id: 20260513-host1x-bocache-leak-4759384eb792
