All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev,
	Martin Fuzzey <martin.fuzzey@flowbird.group>,
	Lucas Stach <l.stach@pengutronix.de>
Subject: [PATCH 4.14 04/66] drm: etvnaviv: fix bad backport leading to warning
Date: Mon, 23 Oct 2023 12:55:54 +0200	[thread overview]
Message-ID: <20231023104810.945378602@linuxfoundation.org> (raw)
In-Reply-To: <20231023104810.781270702@linuxfoundation.org>

4.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Martin Fuzzey <martin.fuzzey@flowbird.group>

When updating from 5.4.219 -> 5.4.256 I started getting a runtime warning:

[   58.229857] ------------[ cut here ]------------
[   58.234599] WARNING: CPU: 1 PID: 565 at drivers/gpu/drm/drm_gem.c:1020 drm_gem_object_put+0x90/0x98
[   58.249935] Modules linked in: qmi_wwan cdc_wdm option usb_wwan smsc95xx rsi_usb rsi_91x btrsi ci_hdrc_imx ci_hdrc
[   58.260499] ueventd: modprobe usb:v2F8Fp7FFFd0200dc00dsc00dp00icFEisc01ip02in00 done
[   58.288877] CPU: 1 PID: 565 Comm: android.display Not tainted 5.4.256pkn-5.4-bsp-snapshot-svn-7423 #2195
[   58.288883] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
[   58.288888] Backtrace:
[   58.288912] [<c010e784>] (dump_backtrace) from [<c010eaa4>] (show_stack+0x20/0x24)
[   58.288920]  r7:00000000 r6:60010013 r5:00000000 r4:c14cd224
[   58.328337] [<c010ea84>] (show_stack) from [<c0cf9ca4>] (dump_stack+0xe8/0x120)
[   58.335661] [<c0cf9bbc>] (dump_stack) from [<c012efd0>] (__warn+0xd4/0xe8)
[   58.342542]  r10:eda54000 r9:c06ca53c r8:000003fc r7:00000009 r6:c111ed54 r5:00000000
[   58.350374]  r4:00000000 r3:76cf564a
[   58.353957] [<c012eefc>] (__warn) from [<c012f094>] (warn_slowpath_fmt+0xb0/0xc0)
[   58.361445]  r9:00000009 r8:c06ca53c r7:000003fc r6:c111ed54 r5:c1406048 r4:00000000
[   58.369198] [<c012efe8>] (warn_slowpath_fmt) from [<c06ca53c>] (drm_gem_object_put+0x90/0x98)
[   58.377728]  r9:edda7e40 r8:edd39360 r7:ad16e000 r6:edda7eb0 r5:00000000 r4:edaa3200
[   58.385524] [<c06ca4ac>] (drm_gem_object_put) from [<bf0125a8>] (etnaviv_gem_prime_mmap_obj+0x34/0x3c [etnaviv])
[   58.395704]  r5:00000000 r4:edaa3200
[   58.399334] [<bf012574>] (etnaviv_gem_prime_mmap_obj [etnaviv]) from [<bf0143a0>] (etnaviv_gem_mmap+0x3c/0x60 [etnaviv])
[   58.410205]  r5:edd39360 r4:00000000
[   58.413816] [<bf014364>] (etnaviv_gem_mmap [etnaviv]) from [<c02c5e08>] (mmap_region+0x37c/0x67c)
[   58.422689]  r5:ad16d000 r4:edda7eb8
[   58.426272] [<c02c5a8c>] (mmap_region) from [<c02c6528>] (do_mmap+0x420/0x544)
[   58.433500]  r10:000000fb r9:000fffff r8:ffffffff r7:00000001 r6:00000003 r5:00000001
[   58.441330]  r4:00001000
[   58.443876] [<c02c6108>] (do_mmap) from [<c02a5b2c>] (vm_mmap_pgoff+0xd0/0x100)
[   58.451190]  r10:eda54040 r9:00001000 r8:00000000 r7:00000000 r6:00000003 r5:c1406048
[   58.459020]  r4:edb8ff24
[   58.461561] [<c02a5a5c>] (vm_mmap_pgoff) from [<c02c3ac8>] (ksys_mmap_pgoff+0xdc/0x10c)
[   58.469570]  r10:000000c0 r9:edb8e000 r8:ed650b40 r7:00000003 r6:00001000 r5:00000000
[   58.477400]  r4:00000001
[   58.479941] [<c02c39ec>] (ksys_mmap_pgoff) from [<c02c3b24>] (sys_mmap_pgoff+0x2c/0x34)
[   58.487949]  r8:c0101224 r7:000000c0 r6:951ece38 r5:00010001 r4:00000065
[   58.494658] [<c02c3af8>] (sys_mmap_pgoff) from [<c0101000>] (ret_fast_syscall+0x0/0x28)

It looks like this was a backporting error for the upstream patch
963b2e8c428f "drm/etnaviv: fix reference leak when mmaping imported buffer"

In the 5.4 kernel there are 2 variants of the object put function:
	drm_gem_object_put() [which requires lock to be held]
	drm_gem_object_put_unlocked() [which requires lock to be NOT held]

In later kernels [5.14+] this has gone and there just drm_gem_object_put()
which requires lock to be NOT held.

So the memory leak pach, which added a call to drm_gem_object_put() was correct
on newer kernels but wrong on 5.4 and earlier ones.

So switch back to using the _unlocked variant for old kernels.
This should only be applied to the 5.4, 4.19 and 4.14 longterm branches;
mainline and more recent longterms already have the correct fix.

Signed-off-by: Martin Fuzzey <martin.fuzzey@flowbird.group>
Fixes: 0c6df5364798 "drm/etnaviv: fix reference leak when mmaping imported buffer" [5.4.y]
Fixes: 0838cb217a52 "drm/etnaviv: fix reference leak when mmaping imported buffer" [4.19.y]
Fixes: 1c9544fbc979 "drm/etnaviv: fix reference leak when mmaping imported buffer" [4.14.y]
Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
@@ -107,7 +107,7 @@ static int etnaviv_gem_prime_mmap_obj(st
 	ret = dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0);
 	if (!ret) {
 		/* Drop the reference acquired by drm_gem_mmap_obj(). */
-		drm_gem_object_put(&etnaviv_obj->base);
+		drm_gem_object_put_unlocked(&etnaviv_obj->base);
 	}
 
 	return ret;



  parent reply	other threads:[~2023-10-23 10:59 UTC|newest]

Thread overview: 74+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-10-23 10:55 [PATCH 4.14 00/66] 4.14.328-rc1 review Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 4.14 01/66] RDMA/cxgb4: Check skb value for failure to allocate Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 4.14 02/66] platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section mismatch warning Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 4.14 03/66] HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect Greg Kroah-Hartman
2023-10-23 10:55 ` Greg Kroah-Hartman [this message]
2023-10-23 10:55 ` [PATCH 4.14 05/66] ieee802154: ca8210: Fix a potential UAF in ca8210_probe Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 4.14 06/66] drm/vmwgfx: fix typo of sizeof argument Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 4.14 07/66] ixgbe: fix crash with empty VF macvlan list Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 4.14 08/66] nfc: nci: assert requested protocol is valid Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 4.14 09/66] workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 10/66] usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 11/66] net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 12/66] usb: musb: Get the musb_qh poniter after musb_giveback Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 13/66] usb: musb: Modify the "HWVers" register address Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 14/66] iio: pressure: bmp280: Fix NULL pointer exception Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 15/66] iio: pressure: ms5611: ms5611_prom_is_valid false negative bug Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 16/66] mcb: remove is_added flag from mcb_device struct Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 17/66] ceph: fix incorrect revoked caps assert in ceph_fill_file_size() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 18/66] Input: powermate - fix use-after-free in powermate_config_complete Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 19/66] Input: xpad - add PXN V900 support Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 20/66] cgroup: Remove duplicates in cgroup v1 tasks file Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 21/66] pinctrl: avoid unsafe code pattern in find_pinctrl() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 22/66] usb: gadget: udc-xilinx: replace memcpy with memcpy_toio Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 23/66] usb: gadget: ncm: Handle decoding of multiple NTBs in unwrap call Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 24/66] x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 25/66] usb: hub: Guard against accesses to uninitialized BOS descriptors Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 26/66] Bluetooth: hci_event: Ignore NULL link key Greg Kroah-Hartman
2023-10-23 10:56   ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 27/66] Bluetooth: Reject connection with the device which has same BD_ADDR Greg Kroah-Hartman
2023-10-23 10:56   ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 28/66] Bluetooth: Fix a refcnt underflow problem for hci_conn Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 29/66] Bluetooth: vhci: Fix race when opening vhci device Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 30/66] Bluetooth: hci_event: Fix coding style Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 31/66] Bluetooth: avoid memcmp() out of bounds warning Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 32/66] nfc: nci: fix possible NULL pointer dereference in send_acknowledge() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 33/66] regmap: fix NULL deref on lookup Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 34/66] KVM: x86: Mask LVTPC when handling a PMI Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 35/66] netfilter: nft_payload: fix wrong mac header matching Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 36/66] xfrm: fix a data-race in xfrm_gen_index() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 37/66] net: ipv4: fix return value check in esp_remove_trailer Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 38/66] net: ipv6: " Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 39/66] net: rfkill: gpio: prevent value glitch during probe Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 40/66] net: usb: smsc95xx: Fix an error code in smsc95xx_reset() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 41/66] i40e: prevent crash on probe if hw registers have invalid values Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 42/66] ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 43/66] btrfs: initialize start_slot in btrfs_log_prealloc_extents Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 44/66] i2c: mux: Avoid potential false error message in i2c_mux_add_adapter Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 45/66] overlayfs: set ctime when setting mtime and atime Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 46/66] gpio: timberdale: Fix potential deadlock on &tgpio->lock Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 47/66] ata: libata-eh: Fix compilation warning in ata_eh_link_report() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 48/66] tracing: relax trace_event_eval_update() execution with cond_resched() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 49/66] HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 50/66] Bluetooth: Avoid redundant authentication Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 51/66] Bluetooth: hci_core: Fix build warnings Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 52/66] wifi: mac80211: allow transmitting EAPOL frames with tainted key Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 53/66] wifi: cfg80211: avoid leaking stack data into trace Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 54/66] sky2: Make sure there is at least one frag_addr available Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 55/66] mmc: core: Capture correct oemid-bits for eMMC cards Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 56/66] Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 57/66] ACPI: irq: Fix incorrect return value in acpi_register_gsi() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 58/66] USB: serial: option: add Telit LE910C4-WWX 0x1035 composition Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 59/66] USB: serial: option: add entry for Sierra EM9191 with new firmware Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 60/66] USB: serial: option: add Fibocom to DELL custom modem FM101R-GL Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 61/66] perf: Disallow mis-matched inherited group reads Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 62/66] s390/pci: fix iommu bitmap allocation Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 63/66] gpio: vf610: set value before the direction to avoid a glitch Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 64/66] Bluetooth: hci_sock: fix slab oob read in create_monitor_event Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 65/66] Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 4.14 66/66] Bluetooth: hci_event: Fix using memcmp when comparing keys Greg Kroah-Hartman
2023-10-23 14:37 ` [PATCH 4.14 00/66] 4.14.328-rc1 review Guenter Roeck
2023-10-24  8:22   ` Greg Kroah-Hartman
2023-10-23 20:43 ` Pavel Machek
2023-10-24  8:36 ` Daniel Díaz
2023-10-25 18:57 ` Jon Hunter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20231023104810.945378602@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=l.stach@pengutronix.de \
    --cc=martin.fuzzey@flowbird.group \
    --cc=patches@lists.linux.dev \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.