From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.0 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,INCLUDES_PATCH,MAILING_LIST_MULTI, NICE_REPLY_A,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D453AC433E0 for ; Mon, 3 Aug 2020 11:23:57 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id ADEE020738 for ; Mon, 3 Aug 2020 11:23:57 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org ADEE020738 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id EDF786E261; Mon, 3 Aug 2020 11:23:57 +0000 (UTC) Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by gabe.freedesktop.org (Postfix) with ESMTPS id E9FD66E262 for ; Mon, 3 Aug 2020 11:23:56 +0000 (UTC) IronPort-SDR: qJ/29/++7jz2Pg9bFaHSb6Ji4GJHs8VbF8NCb16PwHiIdsqIPnWNf83UVbxSBcegZW+O07HYXS HiTUMcIH1JqA== X-IronPort-AV: E=McAfee;i="6000,8403,9701"; a="153281791" X-IronPort-AV: E=Sophos;i="5.75,429,1589266800"; d="scan'208,217";a="153281791" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Aug 2020 04:23:56 -0700 IronPort-SDR: 0BV+lsHhxkDSI/KA//AT0o13RZSlsBxuBT4qEIZQD2kd2/be+sYEeXiK3WnbGnXd7Bdc4Zws8W h2QAgHPJxZXA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.75,429,1589266800"; d="scan'208,217";a="491791375" Received: from aknautiy-mobl.gar.corp.intel.com (HELO [10.252.159.245]) ([10.252.159.245]) by fmsmga006.fm.intel.com with ESMTP; 03 Aug 2020 04:23:52 -0700 Subject: Re: [PATCH] drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi To: Xin Xiong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Daniel Vetter , "dri-devel@lists.freedesktop.org" , "linux-kernel@vger.kernel.org" References: <20200719154545.GA41231@xin-virtual-machine> From: "Nautiyal, Ankit K" Message-ID: Date: Mon, 3 Aug 2020 16:53:52 +0530 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: <20200719154545.GA41231@xin-virtual-machine> X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Xin Tan , "yuanxzhang@fudan.edu.cn" , Xiyu Yang Content-Type: multipart/mixed; boundary="===============0224718105==" Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" This is a multi-part message in MIME format. --===============0224718105== Content-Type: multipart/alternative; boundary="------------6E1028B7AD6C345B6FE00826" This is a multi-part message in MIME format. --------------6E1028B7AD6C345B6FE00826 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Hi Xin Xong, I have seen insufficient vcpi ports issues with MST daisy chain. While running the IGT tests on MST, some times the vcpi ports are all used up. Due to this the atomic check fails and the flips start failing with ENOSPC. https://gitlab.freedesktop.org/drm/intel/-/issues/1255 I think this patch would be fixing this. Regards, Ankit On 7/19/2020 9:15 PM, Xin Xiong wrote: > drm_dp_mst_allocate_vcpi() invokes > drm_dp_mst_topology_get_port_validated(), which increases the refcount > of the "port". > > These reference counting issues take place in two exception handling > paths separately. Either when “slots” is less than 0 or when > drm_dp_init_vcpi() returns a negative value, the function forgets to > reduce the refcnt increased drm_dp_mst_topology_get_port_validated(), > which results in a refcount leak. > > Fix these issues by pulling up the error handling when "slots" is less > than 0, and calling drm_dp_mst_topology_put_port() before termination > when drm_dp_init_vcpi() returns a negative value. > > Signed-off-by: Xiyu Yang > Signed-off-by: Xin Tan > Signed-off-by: Xin Xiong > --- > drivers/gpu/drm/drm_dp_mst_topology.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c > index 1e26b89628f9..97b48b531ec6 100644 > --- a/drivers/gpu/drm/drm_dp_mst_topology.c > +++ b/drivers/gpu/drm/drm_dp_mst_topology.c > @@ -4261,11 +4261,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr, > { > int ret; > > - port = drm_dp_mst_topology_get_port_validated(mgr, port); > - if (!port) > + if (slots < 0) > return false; > > - if (slots < 0) > + port = drm_dp_mst_topology_get_port_validated(mgr, port); > + if (!port) > return false; > > if (port->vcpi.vcpi > 0) { > @@ -4281,6 +4281,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr, > if (ret) { > DRM_DEBUG_KMS("failed to init vcpi slots=%d max=63 ret=%d\n", > DIV_ROUND_UP(pbn, mgr->pbn_div), ret); > + drm_dp_mst_topology_put_port(port); > goto out; > } > DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n", --------------6E1028B7AD6C345B6FE00826 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

Hi Xin Xong,

I have seen insufficient vcpi ports issues with MST daisy chain. While running the IGT tests on MST, some times the vcpi ports are all used up.

Due to this the atomic check fails and the flips start failing with ENOSPC.

https://gitlab.freedesktop.org/drm/intel/-/issues/1255

I think this patch would be fixing this.

Regards,
Ankit

On 7/19/2020 9:15 PM, Xin Xiong wrote:
drm_dp_mst_allocate_vcpi() invokes
drm_dp_mst_topology_get_port_validated(), which increases the refcount
of the "port".

These reference counting issues take place in two exception handling
paths separately. Either when “slots” is less than 0 or when
drm_dp_init_vcpi() returns a negative value, the function forgets to
reduce the refcnt increased drm_dp_mst_topology_get_port_validated(),
which results in a refcount leak.

Fix these issues by pulling up the error handling when "slots" is less
than 0, and calling drm_dp_mst_topology_put_port() before termination
when drm_dp_init_vcpi() returns a negative value.

Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
---
 drivers/gpu/drm/drm_dp_mst_topology.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 1e26b89628f9..97b48b531ec6 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -4261,11 +4261,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr,
 {
 	int ret;
 
-	port = drm_dp_mst_topology_get_port_validated(mgr, port);
-	if (!port)
+	if (slots < 0)
 		return false;
 
-	if (slots < 0)
+	port = drm_dp_mst_topology_get_port_validated(mgr, port);
+	if (!port)
 		return false;
 
 	if (port->vcpi.vcpi > 0) {
@@ -4281,6 +4281,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr,
 	if (ret) {
 		DRM_DEBUG_KMS("failed to init vcpi slots=%d max=63 ret=%d\n",
 			      DIV_ROUND_UP(pbn, mgr->pbn_div), ret);
+		drm_dp_mst_topology_put_port(port);
 		goto out;
 	}
 	DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n",

--------------6E1028B7AD6C345B6FE00826-- --===============0224718105== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel --===============0224718105==--