On Tue, Jun 12, 2012 at 8:50 AM, Konrad Rzeszutek Wilk
<konrad.wilk at oracle.com> wrote:
> On Tue, Jun 12, 2012 at 01:28:42PM +0200, Thomas Hellstrom wrote:
>> A regression was introduced in the 3.3 rc series, commit
>> "drm/ttm: simplify memory accounting for ttm user v2",
>> causing the metadata of buffer objects created using the ttm_bo_create()
>> function to be accounted twice.
>> That causes massive leaks with the vmwgfx driver running for example
>> SpecViewperf Catia-03 test 2, eventually killing the app.
>>
>> Furthermore, the same commit introduces a regression where
>> metadata accounting is leaked if a buffer object is
>> initialized with an illegal size. This is also fixed with this commit.
>>
>> v2: Fixed an error path and removed an unused variable.
>>
>> Signed-off-by: Thomas Hellstrom <thellstrom at vmware.com>
>> Cc: Jerome Glisse <jglisse at redhat.com>
>> Cc: stable at vger.kernel.org
>
> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk at oracle.com>
Reviewed-by: Jerome Glisse <jglisse at redhat.com>
>> ---
>> ?drivers/gpu/drm/ttm/ttm_bo.c | ? 13 +++----------
>> ?1 files changed, 3 insertions(+), 10 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
>> index b67cfca..36f4b28 100644
>> --- a/drivers/gpu/drm/ttm/ttm_bo.c
>> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
>> @@ -1204,6 +1204,7 @@ int ttm_bo_init(struct ttm_bo_device *bdev,
>> ? ? ? ? ? ? ? ? ? ? ? (*destroy)(bo);
>> ? ? ? ? ? ? ? else
>> ? ? ? ? ? ? ? ? ? ? ? kfree(bo);
>> + ? ? ? ? ? ? ttm_mem_global_free(mem_glob, acc_size);
>> ? ? ? ? ? ? ? return -EINVAL;
>> ? ? ? }
>> ? ? ? bo->destroy = destroy;
>> @@ -1307,22 +1308,14 @@ int ttm_bo_create(struct ttm_bo_device *bdev,
>> ? ? ? ? ? ? ? ? ? ? ? struct ttm_buffer_object **p_bo)
>> ?{
>> ? ? ? struct ttm_buffer_object *bo;
>> - ? ? struct ttm_mem_global *mem_glob = bdev->glob->mem_glob;
>> ? ? ? size_t acc_size;
>> ? ? ? int ret;
>>
>> - ? ? acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct
>> ttm_buffer_object));
>> - ? ? ret = ttm_mem_global_alloc(mem_glob, acc_size, false, false);
>> - ? ? if (unlikely(ret != 0))
>> - ? ? ? ? ? ? return ret;
>> -
>> ? ? ? bo = kzalloc(sizeof(*bo), GFP_KERNEL);
>> -
>> - ? ? if (unlikely(bo == NULL)) {
>> - ? ? ? ? ? ? ttm_mem_global_free(mem_glob, acc_size);
>> + ? ? if (unlikely(bo == NULL))
>> ? ? ? ? ? ? ? return -ENOMEM;
>> - ? ? }
>>
>> + ? ? acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct
>> ttm_buffer_object));
>> ? ? ? ret = ttm_bo_init(bdev, bo, size, type, placement, page_alignment,
>> ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? buffer_start, interruptible,
>> ? ? ? ? ? ? ? ? ? ? ? ? persistent_swap_storage, acc_size, NULL, NULL);
>> --
>> 1.7.7.5
>>
>> _______________________________________________
>> dri-devel mailing list
>> dri-devel at lists.freedesktop.org
>> http://lists.freedesktop.org/mailman/listinfo/dri-devel
> _______________________________________________
> dri-devel mailing list
> dri-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel
