From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794591048; b=DUPVuZlYr9ZUJ+I1ifdvDKebIylQYqK6fHxQk0tVkNQ1YTwwFBh+jWjLVHAdgQ6qJNTY 2O61JWM4n1rLfe+iXU64DF4yo4L0gNSV+hOzACatsUxYFAPnLuryqBS6ixHuqiifSOAsP ZXhoamPBJ5RXF/wDN1VIVtOXUcwir9ItbLZWr8Coy3dMdwCt4jSjfNhEEhihO/91x4lSx Fj9u2wfw+mRlUOQ85Jb96dGK3nvtaYQL5QpsOnXkfJU0VqCXAs4fM0JasrSJ6eVJ/WH+n v3CgvR16Ru9HaD4m6AgyRI3k3hH2u+se7siPnJA1nHxD/EFBSueGO7YopJrpQIyh+Og== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794591048; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=jzod33bezWyVeOrH0o69V/dJPsiIlnnKViJwNN8oufc=; b=qXtrJkwuzZ1T4h5Hmi6N38Ekq3fzVHk9Exu5cnxllcSQ0KHPu/tqS38oyRstZXmN6Wgr NnBB9PNQGlvbEwojk1MKBrx1FsUMjZbAX+SsJdvaWbe8krLBSHXw59keR/c7hHM8ozmwl tc6MfzkOZentHl/tMNM9Xeqpqnb1PCkY5avGWXY0fk75nsdifsafoXWQKzjH9y+bsOIZ3 KFiKuIDugpe/9X6KuGgKXUFAhP1cO5IetPtbEe6f7BODoXSCwkbGSAgvz5ORJXj8z+GCO KpuoIy+VyizbXZLYHGvJmK4oiudSKTSouX/ZSaNoEZwt+e7CSyRJtzL8UdsiI0ZSwlg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=kqkqLR1j; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 22EDB606B357; Fri, 13 Nov 2026 17:30:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=kqkqLR1j Received: by smtp.kernel.org (Postfix) with ESMTPSA id C30DE1F000C4; Fri, 13 Nov 2026 17:30:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794591048; bh=jzod33bezWyVeOrH0o69V/dJPsiIlnnKViJwNN8oufc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=kqkqLR1jb9C6ql7QLwDpt7HiYhFftBH8DTouI/5ohUkBjaF7MkS46yJUFtJrfv+cD 0LyhHHBSfNLBofXXXqfxTwIvIwrtjvGApEgmbCFGSeXIciVsYBxEwwJm/dfUybWAFm Qn2Su4rH4X3/wqvZcAoYf28As19J8i+60UdEmdOo= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Evanshenf , Icenowy Zheng , Sasha Levin Subject: [PATCH 6.12 211/670] drm/loongson: Handle buffer mapping failures when clearing a BO Date: Fri, 13 Nov 2026 10:46:15 -0500 Message-ID: <20261113153819.080490280@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153811.177190860@linuxfoundation.org> References: <20261113153811.177190860@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Evanshenf [ Upstream commit f00d7a241f846b053e89c0bb2285ef5988d4cafc ] lsdc_bo_clear() ignores the return value from lsdc_bo_kmap() and writes to lbo->kptr unconditionally. When the first mapping of a newly allocated buffer fails, kptr is still NULL and the subsequent memset accesses it. Return the mapping error without touching the buffer and propagate it from lsdc_gem_object_create(). Install the GEM object functions before clearing so that drm_gem_object_put() can release the buffer correctly on failure. Do not add the failed object to the tracking list or return an uncleared buffer to the caller. Imported buffers still skip clearing, and successfully mapped buffers are cleared and unmapped as before. Tested on LS7A2000 with a one-shot range error in ttm_bo_kmap(). Its -EINVAL return reached userspace, the object was destroyed once, and no GEM handle was published. Normal create/map/zero/write/read/close cycles passed, with the tracked BO count and VRAM usage unchanged. AI assistance was used for the lifetime analysis, fix, fault-injection tools, build and test execution. Fixes: f39db26c5428 ("drm: Add kms driver for loongson display controller") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Evanshenf Reviewed-by: Icenowy Zheng Signed-off-by: Icenowy Zheng Link: https://patch.msgid.link/20261003093415.902f89244043-2-archwse@gmail.com Signed-off-by: Sasha Levin --- drivers/gpu/drm/loongson/lsdc_gem.c | 12 ++++++++---- drivers/gpu/drm/loongson/lsdc_ttm.c | 10 ++++++++-- drivers/gpu/drm/loongson/lsdc_ttm.h | 2 +- 3 files changed, 17 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/loongson/lsdc_gem.c b/drivers/gpu/drm/loongson/lsdc_gem.c index a720d8f532093..5eb6b4f92302b 100644 --- a/drivers/gpu/drm/loongson/lsdc_gem.c +++ b/drivers/gpu/drm/loongson/lsdc_gem.c @@ -155,14 +155,18 @@ struct drm_gem_object *lsdc_gem_object_create(struct drm_device *ddev, return ERR_PTR(ret); } + gobj = &lbo->tbo.base; + gobj->funcs = &lsdc_gem_object_funcs; + if (!sg) { /* VRAM is filled with random data */ - lsdc_bo_clear(lbo); + ret = lsdc_bo_clear(lbo); + if (ret) { + drm_gem_object_put(gobj); + return ERR_PTR(ret); + } } - gobj = &lbo->tbo.base; - gobj->funcs = &lsdc_gem_object_funcs; - /* tracking the BOs we created */ mutex_lock(&ldev->gem.mutex); list_add_tail(&lbo->list, &ldev->gem.objects); diff --git a/drivers/gpu/drm/loongson/lsdc_ttm.c b/drivers/gpu/drm/loongson/lsdc_ttm.c index e8805a2a0db43..17b1998254e23 100644 --- a/drivers/gpu/drm/loongson/lsdc_ttm.c +++ b/drivers/gpu/drm/loongson/lsdc_ttm.c @@ -387,9 +387,13 @@ void lsdc_bo_kunmap(struct lsdc_bo *lbo) ttm_bo_kunmap(&lbo->kmap); } -void lsdc_bo_clear(struct lsdc_bo *lbo) +int lsdc_bo_clear(struct lsdc_bo *lbo) { - lsdc_bo_kmap(lbo); + int ret; + + ret = lsdc_bo_kmap(lbo); + if (ret) + return ret; if (lbo->is_iomem) memset_io((void __iomem *)lbo->kptr, 0, lbo->size); @@ -397,6 +401,8 @@ void lsdc_bo_clear(struct lsdc_bo *lbo) memset(lbo->kptr, 0, lbo->size); lsdc_bo_kunmap(lbo); + + return 0; } int lsdc_bo_evict_vram(struct drm_device *ddev) diff --git a/drivers/gpu/drm/loongson/lsdc_ttm.h b/drivers/gpu/drm/loongson/lsdc_ttm.h index 843e1475064e2..df47d9bb0d035 100644 --- a/drivers/gpu/drm/loongson/lsdc_ttm.h +++ b/drivers/gpu/drm/loongson/lsdc_ttm.h @@ -89,7 +89,7 @@ size_t lsdc_bo_size(struct lsdc_bo *lbo); int lsdc_bo_kmap(struct lsdc_bo *lbo); void lsdc_bo_kunmap(struct lsdc_bo *lbo); -void lsdc_bo_clear(struct lsdc_bo *lbo); +int lsdc_bo_clear(struct lsdc_bo *lbo); int lsdc_bo_evict_vram(struct drm_device *ddev); -- 2.53.0