Re: [PATCH -fixes] drm/ttm: Fix buffer object metadata accounting regression v2

[Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>]

On Tue, Jun 12, 2012 at 01:28:42PM +0200, Thomas Hellstrom wrote:
> A regression was introduced in the 3.3 rc series, commit
> "drm/ttm: simplify memory accounting for ttm user v2",
> causing the metadata of buffer objects created using the ttm_bo_create()
> function to be accounted twice.
> That causes massive leaks with the vmwgfx driver running for example
> SpecViewperf Catia-03 test 2, eventually killing the app.
> 
> Furthermore, the same commit introduces a regression where
> metadata accounting is leaked if a buffer object is
> initialized with an illegal size. This is also fixed with this commit.
> 
> v2: Fixed an error path and removed an unused variable.
> 
> Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
> Cc: Jerome Glisse <jglisse@redhat.com>
> Cc: stable@vger.kernel.org

Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> ---
>  drivers/gpu/drm/ttm/ttm_bo.c |   13 +++----------
>  1 files changed, 3 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> index b67cfca..36f4b28 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> @@ -1204,6 +1204,7 @@ int ttm_bo_init(struct ttm_bo_device *bdev,
>  			(*destroy)(bo);
>  		else
>  			kfree(bo);
> +		ttm_mem_global_free(mem_glob, acc_size);
>  		return -EINVAL;
>  	}
>  	bo->destroy = destroy;
> @@ -1307,22 +1308,14 @@ int ttm_bo_create(struct ttm_bo_device *bdev,
>  			struct ttm_buffer_object **p_bo)
>  {
>  	struct ttm_buffer_object *bo;
> -	struct ttm_mem_global *mem_glob = bdev->glob->mem_glob;
>  	size_t acc_size;
>  	int ret;
>  
> -	acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct ttm_buffer_object));
> -	ret = ttm_mem_global_alloc(mem_glob, acc_size, false, false);
> -	if (unlikely(ret != 0))
> -		return ret;
> -
>  	bo = kzalloc(sizeof(*bo), GFP_KERNEL);
> -
> -	if (unlikely(bo == NULL)) {
> -		ttm_mem_global_free(mem_glob, acc_size);
> +	if (unlikely(bo == NULL))
>  		return -ENOMEM;
> -	}
>  
> +	acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct ttm_buffer_object));
>  	ret = ttm_bo_init(bdev, bo, size, type, placement, page_alignment,
>  				buffer_start, interruptible,
>  			  persistent_swap_storage, acc_size, NULL, NULL);
> -- 
> 1.7.7.5
> 
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel