From: <Roman.Li@amd.com>
To: <amd-gfx@lists.freedesktop.org>
Cc: <Harry.Wentland@amd.com>, <Sunpeng.Li@amd.com>,
<Rodrigo.Siqueira@amd.com>, <Aurabindo.Pillai@amd.com>,
<roman.li@amd.com>, <wayne.lin@amd.com>,
<agustin.gutierrez@amd.com>, <chiahsuan.chung@amd.com>,
<jerry.zuo@amd.com>, <zaeem.mohamed@amd.com>,
Tim Huang <tim.huang@amd.com>,
Rodrigo Siqueira <rodrigo.siqueira@amd.com>
Subject: [PATCH 10/13] drm/amd/display: fix double free issue during amdgpu module unload
Date: Thu, 15 Aug 2024 18:45:22 -0400 [thread overview]
Message-ID: <20240815224525.3077505-11-Roman.Li@amd.com> (raw)
In-Reply-To: <20240815224525.3077505-1-Roman.Li@amd.com>
From: Tim Huang <tim.huang@amd.com>
Flexible endpoints use DIGs from available inflexible endpoints,
so only the encoders of inflexible links need to be freed.
Otherwise, a double free issue may occur when unloading the
amdgpu module.
[ 279.190523] RIP: 0010:__slab_free+0x152/0x2f0
[ 279.190577] Call Trace:
[ 279.190580] <TASK>
[ 279.190582] ? show_regs+0x69/0x80
[ 279.190590] ? die+0x3b/0x90
[ 279.190595] ? do_trap+0xc8/0xe0
[ 279.190601] ? do_error_trap+0x73/0xa0
[ 279.190605] ? __slab_free+0x152/0x2f0
[ 279.190609] ? exc_invalid_op+0x56/0x70
[ 279.190616] ? __slab_free+0x152/0x2f0
[ 279.190642] ? asm_exc_invalid_op+0x1f/0x30
[ 279.190648] ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu]
[ 279.191096] ? __slab_free+0x152/0x2f0
[ 279.191102] ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu]
[ 279.191469] kfree+0x260/0x2b0
[ 279.191474] dcn10_link_encoder_destroy+0x19/0x30 [amdgpu]
[ 279.191821] link_destroy+0xd7/0x130 [amdgpu]
[ 279.192248] dc_destruct+0x90/0x270 [amdgpu]
[ 279.192666] dc_destroy+0x19/0x40 [amdgpu]
[ 279.193020] amdgpu_dm_fini+0x16e/0x200 [amdgpu]
[ 279.193432] dm_hw_fini+0x26/0x40 [amdgpu]
[ 279.193795] amdgpu_device_fini_hw+0x24c/0x400 [amdgpu]
[ 279.194108] amdgpu_driver_unload_kms+0x4f/0x70 [amdgpu]
[ 279.194436] amdgpu_pci_remove+0x40/0x80 [amdgpu]
[ 279.194632] pci_device_remove+0x3a/0xa0
[ 279.194638] device_remove+0x40/0x70
[ 279.194642] device_release_driver_internal+0x1ad/0x210
[ 279.194647] driver_detach+0x4e/0xa0
[ 279.194650] bus_remove_driver+0x6f/0xf0
[ 279.194653] driver_unregister+0x33/0x60
[ 279.194657] pci_unregister_driver+0x44/0x90
[ 279.194662] amdgpu_exit+0x19/0x1f0 [amdgpu]
[ 279.194939] __do_sys_delete_module.isra.0+0x198/0x2f0
[ 279.194946] __x64_sys_delete_module+0x16/0x20
[ 279.194950] do_syscall_64+0x58/0x120
[ 279.194954] entry_SYSCALL_64_after_hwframe+0x6e/0x76
[ 279.194980] </TASK>
Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
Signed-off-by: Tim Huang <tim.huang@amd.com>
Reviewed-by: Roman Li <roman.li@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
---
drivers/gpu/drm/amd/display/dc/link/link_factory.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/link/link_factory.c b/drivers/gpu/drm/amd/display/dc/link/link_factory.c
index 85fd6e422238..5e1b5ab9fbc6 100644
--- a/drivers/gpu/drm/amd/display/dc/link/link_factory.c
+++ b/drivers/gpu/drm/amd/display/dc/link/link_factory.c
@@ -385,7 +385,7 @@ static void link_destruct(struct dc_link *link)
if (link->panel_cntl)
link->panel_cntl->funcs->destroy(&link->panel_cntl);
- if (link->link_enc) {
+ if (link->link_enc && !link->is_dig_mapping_flexible) {
/* Update link encoder resource tracking variables. These are used for
* the dynamic assignment of link encoders to streams. Virtual links
* are not assigned encoder resources on creation.
--
2.34.1
next prev parent reply other threads:[~2024-08-15 22:45 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-08-15 22:45 [PATCH 00/13] DC Patches August 15, 2024 Roman.Li
2024-08-15 22:45 ` [PATCH 01/13] Revert "drm/amd/display: Update to using new dccg callbacks" Roman.Li
2024-08-15 22:45 ` [PATCH 02/13] drm/amd/display: Update HPO I/O When Handling Link Retrain Automation Request Roman.Li
2024-08-15 22:45 ` [PATCH 03/13] drm/amd/display: remove an extraneous call for checking dchub clock Roman.Li
2024-08-15 22:45 ` [PATCH 04/13] drm/amd/display: Remove redundant check in DCN35 hwseq Roman.Li
2024-08-15 22:45 ` [PATCH 05/13] drm/amd/display: Allow UHBR Interop With eDP Supported Link Rates Table Roman.Li
2024-08-15 22:45 ` [PATCH 06/13] drm/amd/display: Hardware cursor changes color when switched to software cursor Roman.Li
2024-08-15 22:45 ` [PATCH 07/13] drm/amd/display: Support UHBR10 link rate on eDP Roman.Li
2024-08-15 22:45 ` [PATCH 08/13] drm/amd/display: Fix construct_phy with MXM connector Roman.Li
2024-08-15 22:45 ` [PATCH 09/13] drm/amd/display: DCN35 set min dispclk to 50Mhz Roman.Li
2024-08-15 22:45 ` Roman.Li [this message]
2024-08-15 22:45 ` [PATCH 11/13] drm/amd/display: DML2.1 Reintegration for Various Fixes Roman.Li
2024-08-15 22:45 ` [PATCH 12/13] drm/amd/display: Fix a typo in revert commit Roman.Li
2024-08-16 19:30 ` Li, Roman
2024-08-19 8:37 ` Jiri Slaby
2024-08-19 14:29 ` Li, Roman
2024-08-20 4:49 ` Jiri Slaby
2024-08-20 18:28 ` Zuo, Jerry
2024-08-21 4:24 ` Jiri Slaby
2024-08-21 19:50 ` Zuo, Jerry
2024-08-15 22:45 ` [PATCH 13/13] drm/amd/display: Promote DC to 3.2.297 Roman.Li
2024-08-16 18:47 ` [PATCH 00/13] DC Patches August 15, 2024 Wheeler, Daniel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240815224525.3077505-11-Roman.Li@amd.com \
--to=roman.li@amd.com \
--cc=Aurabindo.Pillai@amd.com \
--cc=Harry.Wentland@amd.com \
--cc=Rodrigo.Siqueira@amd.com \
--cc=Sunpeng.Li@amd.com \
--cc=agustin.gutierrez@amd.com \
--cc=amd-gfx@lists.freedesktop.org \
--cc=chiahsuan.chung@amd.com \
--cc=jerry.zuo@amd.com \
--cc=tim.huang@amd.com \
--cc=wayne.lin@amd.com \
--cc=zaeem.mohamed@amd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox