Re: [Nouveau] [PATCH] drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
Reviewed-by: Lyude Paul
Will push
On Tue, 2022-07-05 at 17:43 +0800, Jianglei Nie wrote:
> nouveau_bo_alloc() allocates a memory chunk for "nvbo" with kzalloc().
> When some error occurs, "nvbo" should be released. But when
> WARN_ON(pi < 0)) equals true, the function return ERR_PTR without
> releasing the "nvbo", which will lead to a memory leak.
>
> We should release the "nvbo" with kfree() if WARN_ON(pi < 0)) equals true.
>
> Signed-off-by: Jianglei Nie
> ---
> drivers/gpu/drm/nouveau/nouveau_bo.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c
> b/drivers/gpu/drm/nouveau/nouveau_bo.c
> index 05076e530e7d..d0887438b07e 100644
> --- a/drivers/gpu/drm/nouveau/nouveau_bo.c
> +++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
> @@ -281,8 +281,10 @@ nouveau_bo_alloc(struct nouveau_cli *cli, u64 *size,
> int *align, u32 domain,
> break;
> }
>
> - if (WARN_ON(pi < 0))
> + if (WARN_ON(pi < 0)) {
> + kfree(nvbo);
> return ERR_PTR(-EINVAL);
> + }
>
> /* Disable compression if suitable settings couldn't be found. */
> if (nvbo->comp && !vmm->page[pi].comp) {
--
Cheers,
Lyude Paul (she/her)
Software Engineer at Red Hat
Re: [Nouveau] [PATCH] drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
Reviewed-by: Lyude Paul
Will push to the appropriate branch in a moment
On Tue, 2022-07-05 at 21:25 +0800, Jianglei Nie wrote:
> nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code
> back to the caller. On failures, ttm will call nouveau_bo_del_ttm() and
> free the memory.Thus, when nouveau_bo_init() returns an error, the gem
> object has already been released. Then the call to nouveau_bo_ref() will
> use the freed "nvbo->bo" and lead to a use-after-free bug.
>
> We should delete the call to nouveau_bo_ref() to avoid the use-after-free.
>
> Signed-off-by: Jianglei Nie
> ---
> drivers/gpu/drm/nouveau/nouveau_prime.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/nouveau/nouveau_prime.c
> b/drivers/gpu/drm/nouveau/nouveau_prime.c
> index 347488685f74..9608121e49b7 100644
> --- a/drivers/gpu/drm/nouveau/nouveau_prime.c
> +++ b/drivers/gpu/drm/nouveau/nouveau_prime.c
> @@ -71,7 +71,6 @@ struct drm_gem_object
> *nouveau_gem_prime_import_sg_table(struct drm_device *dev,
> ret = nouveau_bo_init(nvbo, size, align, NOUVEAU_GEM_DOMAIN_GART,
> sg, robj);
> if (ret) {
> - nouveau_bo_ref(NULL, );
> obj = ERR_PTR(ret);
> goto unlock;
> }
--
Cheers,
Lyude Paul (she/her)
Software Engineer at Red Hat
Re: [Nouveau] [Intel-gfx] [PATCH 1/6] drm/ttm: rename and cleanup ttm_bo_init_reserved
Hi "Christian, I love your patch! Perhaps something to improve: [auto build test WARNING on drm-tip/drm-tip] url: https://github.com/intel-lab-lkp/linux/commits/Christian-K-nig/drm-ttm-rename-and-cleanup-ttm_bo_init_reserved/20220707-192538 base: git://anongit.freedesktop.org/drm/drm-tip drm-tip config: x86_64-randconfig-a011 (https://download.01.org/0day-ci/archive/20220708/202207080122.b4dlodd2-...@intel.com/config) compiler: gcc-11 (Debian 11.3.0-3) 11.3.0 reproduce (this is a W=1 build): # https://github.com/intel-lab-lkp/linux/commit/607b24f78509a1fb0e55c8f9f610113bb0421706 git remote add linux-review https://github.com/intel-lab-lkp/linux git fetch --no-tags linux-review Christian-K-nig/drm-ttm-rename-and-cleanup-ttm_bo_init_reserved/20220707-192538 git checkout 607b24f78509a1fb0e55c8f9f610113bb0421706 # save the config file mkdir build_dir && cp config build_dir/.config make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash drivers/gpu/drm/ttm/ If you fix the issue, kindly add following tag where applicable Reported-by: kernel test robot All warnings (new ones prefixed by >>): drivers/gpu/drm/ttm/ttm_bo.c:99: warning: Function parameter or member 'bulk' not described in 'ttm_bo_set_bulk_move' >> drivers/gpu/drm/ttm/ttm_bo.c:962: warning: expecting prototype for >> ttm_bo_init_validate(). Prototype was for ttm_bo_init_reserved() instead vim +962 drivers/gpu/drm/ttm/ttm_bo.c ba4e7d973dd09b6 Thomas Hellstrom 2009-06-10 923 607b24f78509a1f Christian König 2022-07-07 924 /** 607b24f78509a1f Christian König 2022-07-07 925 * ttm_bo_init_validate 607b24f78509a1f Christian König 2022-07-07 926 * 607b24f78509a1f Christian König 2022-07-07 927 * @bdev: Pointer to a ttm_device struct. 607b24f78509a1f Christian König 2022-07-07 928 * @bo: Pointer to a ttm_buffer_object to be initialized. 607b24f78509a1f Christian König 2022-07-07 929 * @type: Requested type of buffer object. 607b24f78509a1f Christian König 2022-07-07 930 * @placement: Initial placement for buffer object. 607b24f78509a1f Christian König 2022-07-07 931 * @alignment: Data alignment in pages. 607b24f78509a1f Christian König 2022-07-07 932 * @ctx: TTM operation context for memory allocation. 607b24f78509a1f Christian König 2022-07-07 933 * @sg: Scatter-gather table. 607b24f78509a1f Christian König 2022-07-07 934 * @resv: Pointer to a dma_resv, or NULL to let ttm allocate one. 607b24f78509a1f Christian König 2022-07-07 935 * @destroy: Destroy function. Use NULL for kfree(). 607b24f78509a1f Christian König 2022-07-07 936 * 607b24f78509a1f Christian König 2022-07-07 937 * This function initializes a pre-allocated struct ttm_buffer_object. 607b24f78509a1f Christian König 2022-07-07 938 * As this object may be part of a larger structure, this function, 607b24f78509a1f Christian König 2022-07-07 939 * together with the @destroy function, enables driver-specific objects 607b24f78509a1f Christian König 2022-07-07 940 * derived from a ttm_buffer_object. 607b24f78509a1f Christian König 2022-07-07 941 * 607b24f78509a1f Christian König 2022-07-07 942 * On successful return, the caller owns an object kref to @bo. The kref and 607b24f78509a1f Christian König 2022-07-07 943 * list_kref are usually set to 1, but note that in some situations, other 607b24f78509a1f Christian König 2022-07-07 944 * tasks may already be holding references to @bo as well. 607b24f78509a1f Christian König 2022-07-07 945 * Furthermore, if resv == NULL, the buffer's reservation lock will be held, 607b24f78509a1f Christian König 2022-07-07 946 * and it is the caller's responsibility to call ttm_bo_unreserve. 607b24f78509a1f Christian König 2022-07-07 947 * 607b24f78509a1f Christian König 2022-07-07 948 * If a failure occurs, the function will call the @destroy function. Thus, 607b24f78509a1f Christian König 2022-07-07 949 * after a failure, dereferencing @bo is illegal and will likely cause memory 607b24f78509a1f Christian König 2022-07-07 950 * corruption. 607b24f78509a1f Christian König 2022-07-07 951 * 607b24f78509a1f Christian König 2022-07-07 952 * Returns 607b24f78509a1f Christian König 2022-07-07 953 * -ENOMEM: Out of memory. 607b24f78509a1f Christian König 2022-07-07 954 * -EINVAL: Invalid placement flags. 607b24f78509a1f Christian König 2022-07-07 955 * -ERESTARTSYS: Interrupted by signal while sleeping waiting for resources. 607b24f78509a1f Christian König 2022-07-07 956 */ 607b24f78509a1f Christian König 2022-07-07 957 int ttm_bo_init_reserved(struct ttm_device *bdev, struct ttm_buffer_object *bo, 607b24f78509a1f Christian König 2022-07-07 958 enum ttm_bo_type type, struct ttm_placement *placement, 607b24f78509a1f Chr
[Nouveau] [PATCH 5/6] drm/ttm: stop allocating dummy resources during BO creation
That should not be necessary any more when drivers should at least be
able to handle the move without a resource.
Signed-off-by: Christian König
---
drivers/gpu/drm/ttm/ttm_bo.c | 7 ---
1 file changed, 7 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index a2f49bdda8a1..f491be751a2f 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -960,7 +960,6 @@ int ttm_bo_init_reserved(struct ttm_device *bdev, struct
ttm_buffer_object *bo,
struct sg_table *sg, struct dma_resv *resv,
void (*destroy) (struct ttm_buffer_object *))
{
- static const struct ttm_place sys_mem = { .mem_type = TTM_PL_SYSTEM };
int ret;
kref_init(>kref);
@@ -978,12 +977,6 @@ int ttm_bo_init_reserved(struct ttm_device *bdev, struct
ttm_buffer_object *bo,
bo->base.resv = >base._resv;
atomic_inc(_glob.bo_count);
- ret = ttm_resource_alloc(bo, _mem, >resource);
- if (unlikely(ret)) {
- ttm_bo_put(bo);
- return ret;
- }
-
/*
* For ttm_bo_type_device buffers, allocate
* address space from the device.
--
2.25.1
[Nouveau] [PATCH 2/6] drm/amdgpu: audit bo->resource usage
Make sure we can at least move and release BOs without backing store.
Signed-off-by: Christian König
---
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c| 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index d9cfe259f2a9..677d1dfab37f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -1305,7 +1305,7 @@ void amdgpu_bo_release_notify(struct ttm_buffer_object
*bo)
if (bo->base.resv == >base._resv)
amdgpu_amdkfd_remove_fence_on_pt_pd_bos(abo);
- if (bo->resource->mem_type != TTM_PL_VRAM ||
+ if (!bo->resource || bo->resource->mem_type != TTM_PL_VRAM ||
!(abo->flags & AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE) ||
adev->in_suspend || adev->shutdown)
return;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index be6f76a30ac6..3bddf266e8b5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -471,7 +471,8 @@ static int amdgpu_bo_move(struct ttm_buffer_object *bo,
bool evict,
adev = amdgpu_ttm_adev(bo->bdev);
- if (old_mem->mem_type == TTM_PL_SYSTEM && bo->ttm == NULL) {
+ if (!old_mem || (old_mem->mem_type == TTM_PL_SYSTEM &&
+bo->ttm == NULL)) {
ttm_bo_move_null(bo, new_mem);
goto out;
}
--
2.25.1
[Nouveau] [PATCH 6/6] drm/ttm: stop allocating a dummy resource for pipelined gutting
That should not be necessary any more when drivers should at least be
able to handle a move without a resource.
Signed-off-by: Christian König
---
drivers/gpu/drm/ttm/ttm_bo_util.c | 15 ++-
1 file changed, 2 insertions(+), 13 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c
b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 1530982338e9..1e76149c62ff 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -603,16 +603,10 @@ EXPORT_SYMBOL(ttm_bo_move_sync_cleanup);
*/
int ttm_bo_pipeline_gutting(struct ttm_buffer_object *bo)
{
- static const struct ttm_place sys_mem = { .mem_type = TTM_PL_SYSTEM };
struct ttm_buffer_object *ghost;
- struct ttm_resource *sys_res;
struct ttm_tt *ttm;
int ret;
- ret = ttm_resource_alloc(bo, _mem, _res);
- if (ret)
- return ret;
-
/* If already idle, no need for ghost object dance. */
ret = ttm_bo_wait(bo, false, true);
if (ret != -EBUSY) {
@@ -620,14 +614,13 @@ int ttm_bo_pipeline_gutting(struct ttm_buffer_object *bo)
/* See comment below about clearing. */
ret = ttm_tt_create(bo, true);
if (ret)
- goto error_free_sys_mem;
+ return ret;
} else {
ttm_tt_unpopulate(bo->bdev, bo->ttm);
if (bo->type == ttm_bo_type_device)
ttm_tt_mark_for_clear(bo->ttm);
}
ttm_resource_free(bo, >resource);
- ttm_bo_assign_mem(bo, sys_res);
return 0;
}
@@ -644,7 +637,7 @@ int ttm_bo_pipeline_gutting(struct ttm_buffer_object *bo)
ret = ttm_tt_create(bo, true);
swap(bo->ttm, ttm);
if (ret)
- goto error_free_sys_mem;
+ return ret;
ret = ttm_buffer_object_transfer(bo, );
if (ret)
@@ -658,13 +651,9 @@ int ttm_bo_pipeline_gutting(struct ttm_buffer_object *bo)
dma_resv_unlock(>base._resv);
ttm_bo_put(ghost);
bo->ttm = ttm;
- ttm_bo_assign_mem(bo, sys_res);
return 0;
error_destroy_tt:
ttm_tt_destroy(bo->bdev, ttm);
-
-error_free_sys_mem:
- ttm_resource_free(bo, _res);
return ret;
}
--
2.25.1
[Nouveau] [PATCH 4/6] drm/ttm: audit bo->resource usage v2
Allow BOs to exist without backing store.
v2: handle ttm_bo_move_memcpy as well.
Signed-off-by: Christian König
---
drivers/gpu/drm/ttm/ttm_bo.c | 16
drivers/gpu/drm/ttm/ttm_bo_util.c | 7 +--
2 files changed, 13 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 984535d6a2d0..a2f49bdda8a1 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -117,12 +117,13 @@ static int ttm_bo_handle_move_mem(struct
ttm_buffer_object *bo,
struct ttm_operation_ctx *ctx,
struct ttm_place *hop)
{
- struct ttm_resource_manager *old_man, *new_man;
struct ttm_device *bdev = bo->bdev;
+ bool old_use_tt, new_use_tt;
int ret;
- old_man = ttm_manager_type(bdev, bo->resource->mem_type);
- new_man = ttm_manager_type(bdev, mem->mem_type);
+ old_use_tt = bo->resource &&
+ ttm_manager_type(bdev, bo->resource->mem_type)->use_tt;
+ new_use_tt = ttm_manager_type(bdev, mem->mem_type)->use_tt;
ttm_bo_unmap_virtual(bo);
@@ -130,11 +131,11 @@ static int ttm_bo_handle_move_mem(struct
ttm_buffer_object *bo,
* Create and bind a ttm if required.
*/
- if (new_man->use_tt) {
+ if (new_use_tt) {
/* Zero init the new TTM structure if the old location should
* have used one as well.
*/
- ret = ttm_tt_create(bo, old_man->use_tt);
+ ret = ttm_tt_create(bo, old_use_tt);
if (ret)
goto out_err;
@@ -160,8 +161,7 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object
*bo,
return 0;
out_err:
- new_man = ttm_manager_type(bdev, bo->resource->mem_type);
- if (!new_man->use_tt)
+ if (!old_use_tt)
ttm_bo_tt_destroy(bo);
return ret;
@@ -904,7 +904,7 @@ int ttm_bo_validate(struct ttm_buffer_object *bo,
/*
* Check whether we need to move buffer.
*/
- if (!ttm_resource_compat(bo->resource, placement)) {
+ if (!bo->resource || !ttm_resource_compat(bo->resource, placement)) {
ret = ttm_bo_move_buffer(bo, placement, ctx);
if (ret)
return ret;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c
b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 1cbfb00c1d65..1530982338e9 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -137,8 +137,7 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
ttm_manager_type(bo->bdev, dst_mem->mem_type);
struct ttm_tt *ttm = bo->ttm;
struct ttm_resource *src_mem = bo->resource;
- struct ttm_resource_manager *src_man =
- ttm_manager_type(bdev, src_mem->mem_type);
+ struct ttm_resource_manager *src_man;
union {
struct ttm_kmap_iter_tt tt;
struct ttm_kmap_iter_linear_io io;
@@ -147,6 +146,10 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
bool clear;
int ret = 0;
+ if (!src_mem)
+ return 0;
+
+ src_man = ttm_manager_type(bdev, src_mem->mem_type);
if (ttm && ((ttm->page_flags & TTM_TT_FLAG_SWAPPED) ||
dst_man->use_tt)) {
ret = ttm_tt_populate(bdev, ttm, ctx);
--
2.25.1
[Nouveau] [PATCH 3/6] drm/nouveau: audit bo->resource usage
Make sure we can at least move and release BOs without backing store.
Signed-off-by: Christian König
---
drivers/gpu/drm/nouveau/nouveau_bo.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c
b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 92cd19021084..f83fb43b2e44 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -1006,7 +1006,8 @@ nouveau_bo_move(struct ttm_buffer_object *bo, bool evict,
}
/* Fake bo copy. */
- if (old_reg->mem_type == TTM_PL_SYSTEM && !bo->ttm) {
+ if (!old_reg || (old_reg->mem_type == TTM_PL_SYSTEM &&
+!bo->ttm)) {
ttm_bo_move_null(bo, new_reg);
goto out;
}
--
2.25.1
[Nouveau] Cleanup of TTM NULL resources
Hi guys, sending this out once more since it was requested that the Intel CI systems can take a run of this as well. The last version had a couple of merge/rebase leftovers which are now fixed as well. Please review and/or comment, Christian.
[Nouveau] [PATCH 1/6] drm/ttm: rename and cleanup ttm_bo_init_reserved
Rename ttm_bo_init_reserved to ttm_bo_init_validate since that better
matches what the function is actually doing.
Remove the unused size parameter, move the function's kerneldoc to the
implementation and cleanup the whole error handling.
Signed-off-by: Christian König
---
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 +-
drivers/gpu/drm/drm_gem_vram_helper.c | 6 +-
drivers/gpu/drm/i915/gem/i915_gem_ttm.c| 5 +-
drivers/gpu/drm/nouveau/nouveau_bo.c | 6 +-
drivers/gpu/drm/qxl/qxl_object.c | 2 +-
drivers/gpu/drm/radeon/radeon_object.c | 6 +-
drivers/gpu/drm/ttm/ttm_bo.c | 147 +++--
drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 12 +-
include/drm/ttm/ttm_bo_api.h | 93 ++---
9 files changed, 129 insertions(+), 150 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index 2c82b1d5a0d7..d9cfe259f2a9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -591,7 +591,7 @@ int amdgpu_bo_create(struct amdgpu_device *adev,
if (!bp->destroy)
bp->destroy = _bo_destroy;
- r = ttm_bo_init_reserved(>mman.bdev, >tbo, size, bp->type,
+ r = ttm_bo_init_reserved(>mman.bdev, >tbo, bp->type,
>placement, page_align, , NULL,
bp->resv, bp->destroy);
if (unlikely(r != 0))
diff --git a/drivers/gpu/drm/drm_gem_vram_helper.c
b/drivers/gpu/drm/drm_gem_vram_helper.c
index d607043716d3..125160b534be 100644
--- a/drivers/gpu/drm/drm_gem_vram_helper.c
+++ b/drivers/gpu/drm/drm_gem_vram_helper.c
@@ -226,9 +226,9 @@ struct drm_gem_vram_object *drm_gem_vram_create(struct
drm_device *dev,
* A failing ttm_bo_init will call ttm_buffer_object_destroy
* to release gbo->bo.base and kfree gbo.
*/
- ret = ttm_bo_init(bdev, >bo, size, ttm_bo_type_device,
- >placement, pg_align, false, NULL, NULL,
- ttm_buffer_object_destroy);
+ ret = ttm_bo_init_validate(bdev, >bo, ttm_bo_type_device,
+ >placement, pg_align, false, NULL, NULL,
+ ttm_buffer_object_destroy);
if (ret)
return ERR_PTR(ret);
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
index 4c25d9b2f138..70e2ed4e99df 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
@@ -1229,9 +1229,8 @@ int __i915_gem_ttm_object_init(struct intel_memory_region
*mem,
* Similarly, in delayed_destroy, we can't call ttm_bo_put()
* until successful initialization.
*/
- ret = ttm_bo_init_reserved(>bdev, i915_gem_to_ttm(obj), size,
- bo_type, _sys_placement,
- page_size >> PAGE_SHIFT,
+ ret = ttm_bo_init_reserved(>bdev, i915_gem_to_ttm(obj), bo_type,
+ _sys_placement, page_size >> PAGE_SHIFT,
, NULL, NULL, i915_ttm_bo_destroy);
if (ret)
return i915_ttm_err_to_gem(ret);
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c
b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 05076e530e7d..92cd19021084 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -307,9 +307,9 @@ nouveau_bo_init(struct nouveau_bo *nvbo, u64 size, int
align, u32 domain,
nouveau_bo_placement_set(nvbo, domain, 0);
INIT_LIST_HEAD(>io_reserve_lru);
- ret = ttm_bo_init(nvbo->bo.bdev, >bo, size, type,
- >placement, align >> PAGE_SHIFT, false, sg,
- robj, nouveau_bo_del_ttm);
+ ret = ttm_bo_init_validate(nvbo->bo.bdev, >bo, type,
+ >placement, align >> PAGE_SHIFT, false,
+ sg, robj, nouveau_bo_del_ttm);
if (ret) {
/* ttm will call nouveau_bo_del_ttm if it fails.. */
return ret;
diff --git a/drivers/gpu/drm/qxl/qxl_object.c b/drivers/gpu/drm/qxl/qxl_object.c
index b42a657e4c2f..695d9308d1f0 100644
--- a/drivers/gpu/drm/qxl/qxl_object.c
+++ b/drivers/gpu/drm/qxl/qxl_object.c
@@ -141,7 +141,7 @@ int qxl_bo_create(struct qxl_device *qdev, unsigned long
size,
qxl_ttm_placement_from_domain(bo, domain);
bo->tbo.priority = priority;
- r = ttm_bo_init_reserved(>mman.bdev, >tbo, size, type,
+ r = ttm_bo_init_reserved(>mman.bdev, >tbo, type,
>placement, 0, , NULL, NULL,
_ttm_bo_destroy);
if (unlikely(r != 0)) {
diff --git a/drivers/gpu/drm/radeon/radeon_object.c
b/drivers/gpu/drm/radeon/radeon_object.c
index 6c4a6802ca96..00c33b24d5d3 100644
---
