2020-06-14 06:39:07

by Navid Emamdoost

Subject: [PATCH] drm/panfrost: perfcnt: fix ref count leak in panfrost_perfcnt_enable_locked

in panfrost_perfcnt_enable_locked, pm_runtime_get_sync is called which
increments the counter even in case of failure, leading to incorrect
ref count. In case of failure, decrement the ref count before returning.

Signed-off-by: Navid Emamdoost <[email protected]>
---
drivers/gpu/drm/panfrost/panfrost_perfcnt.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
index 6913578d5aa7..92c64b20eb29 100644
--- a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
+++ b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
@@ -83,11 +83,13 @@ static int panfrost_perfcnt_enable_locked(struct panfrost_device *pfdev,

ret = pm_runtime_get_sync(pfdev->dev);
if (ret < 0)
- return ret;
+ goto err_put_pm;

bo = drm_gem_shmem_create(pfdev->ddev, perfcnt->bosize);
- if (IS_ERR(bo))
- return PTR_ERR(bo);
+ if (IS_ERR(bo)) {
+ ret = PTR_ERR(bo);
+ goto err_put_pm;
+ }

/* Map the perfcnt buf in the address space attached to file_priv. */
ret = panfrost_gem_open(&bo->base, file_priv);
@@ -168,6 +170,8 @@ static int panfrost_perfcnt_enable_locked(struct panfrost_device *pfdev,
panfrost_gem_close(&bo->base, file_priv);
err_put_bo:
drm_gem_object_put_unlocked(&bo->base);
+err_put_pm:
+ pm_runtime_put(pfdev->dev);
return ret;
}

--
2.17.1

2020-07-07 02:32:47

by Alyssa Rosenzweig

Subject: Re: [PATCH] drm/panfrost: perfcnt: fix ref count leak in panfrost_perfcnt_enable_locked

Acked-by: Alyssa Rosenzweig <[email protected]>

On Sun, Jun 14, 2020 at 01:36:19AM -0500, Navid Emamdoost wrote:
> in panfrost_perfcnt_enable_locked, pm_runtime_get_sync is called which
> increments the counter even in case of failure, leading to incorrect
> ref count. In case of failure, decrement the ref count before returning.
>
> Signed-off-by: Navid Emamdoost <[email protected]>
> ---
> drivers/gpu/drm/panfrost/panfrost_perfcnt.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
> index 6913578d5aa7..92c64b20eb29 100644
> --- a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
> +++ b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
> @@ -83,11 +83,13 @@ static int panfrost_perfcnt_enable_locked(struct panfrost_device *pfdev,
>
> ret = pm_runtime_get_sync(pfdev->dev);
> if (ret < 0)
> - return ret;
> + goto err_put_pm;
>
> bo = drm_gem_shmem_create(pfdev->ddev, perfcnt->bosize);
> - if (IS_ERR(bo))
> - return PTR_ERR(bo);
> + if (IS_ERR(bo)) {
> + ret = PTR_ERR(bo);
> + goto err_put_pm;
> + }
>
> /* Map the perfcnt buf in the address space attached to file_priv. */
> ret = panfrost_gem_open(&bo->base, file_priv);
> @@ -168,6 +170,8 @@ static int panfrost_perfcnt_enable_locked(struct panfrost_device *pfdev,
> panfrost_gem_close(&bo->base, file_priv);
> err_put_bo:
> drm_gem_object_put_unlocked(&bo->base);
> +err_put_pm:
> + pm_runtime_put(pfdev->dev);
> return ret;
> }
>
> --
> 2.17.1
>

2020-08-07 16:45:32

by Rob Herring (Arm)

Subject: Re: [PATCH] drm/panfrost: perfcnt: fix ref count leak in panfrost_perfcnt_enable_locked

On Sun, Jun 14, 2020 at 12:36 AM Navid Emamdoost
<[email protected]> wrote:
>
> in panfrost_perfcnt_enable_locked, pm_runtime_get_sync is called which
> increments the counter even in case of failure, leading to incorrect
> ref count. In case of failure, decrement the ref count before returning.
>
> Signed-off-by: Navid Emamdoost <[email protected]>
> ---
> drivers/gpu/drm/panfrost/panfrost_perfcnt.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)

Applied.

Rob