From cb6833d48ea00e15bfd5398a59ca40e8c32f70fd Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 12 Jun 2012 10:05:40 -0700 Subject: [PATCH] 3.4-stable patches added patches: drm-ttm-fix-buffer-object-metadata-accounting-regression-v2.patch --- ...ct-metadata-accounting-regression-v2.patch | 67 +++++++++++++++++++ queue-3.4/series | 1 + 2 files changed, 68 insertions(+) create mode 100644 queue-3.4/drm-ttm-fix-buffer-object-metadata-accounting-regression-v2.patch diff --git a/queue-3.4/drm-ttm-fix-buffer-object-metadata-accounting-regression-v2.patch b/queue-3.4/drm-ttm-fix-buffer-object-metadata-accounting-regression-v2.patch new file mode 100644 index 00000000000..d2289ecdb81 --- /dev/null +++ b/queue-3.4/drm-ttm-fix-buffer-object-metadata-accounting-regression-v2.patch @@ -0,0 +1,67 @@ +From a393c730ab69617c3291a3b0b2a228c9be2fc28c Mon Sep 17 00:00:00 2001 +From: Thomas Hellstrom +Date: Tue, 12 Jun 2012 13:28:42 +0200 +Subject: drm/ttm: Fix buffer object metadata accounting regression v2 + +From: Thomas Hellstrom + +commit a393c730ab69617c3291a3b0b2a228c9be2fc28c upstream. + +A regression was introduced in the 3.3 rc series, commit +"drm/ttm: simplify memory accounting for ttm user v2", +causing the metadata of buffer objects created using the ttm_bo_create() +function to be accounted twice. +That causes massive leaks with the vmwgfx driver running for example +SpecViewperf Catia-03 test 2, eventually killing the app. + +Furthermore, the same commit introduces a regression where +metadata accounting is leaked if a buffer object is +initialized with an illegal size. This is also fixed with this commit. + +v2: Fixed an error path and removed an unused variable. + +Signed-off-by: Thomas Hellstrom +Reviewed-by: Konrad Rzeszutek Wilk +Cc: Jerome Glisse +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/ttm/ttm_bo.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +--- a/drivers/gpu/drm/ttm/ttm_bo.c ++++ b/drivers/gpu/drm/ttm/ttm_bo.c +@@ -1193,6 +1193,7 @@ int ttm_bo_init(struct ttm_bo_device *bd + (*destroy)(bo); + else + kfree(bo); ++ ttm_mem_global_free(mem_glob, acc_size); + return -EINVAL; + } + bo->destroy = destroy; +@@ -1294,22 +1295,14 @@ int ttm_bo_create(struct ttm_bo_device * + struct ttm_buffer_object **p_bo) + { + struct ttm_buffer_object *bo; +- struct ttm_mem_global *mem_glob = bdev->glob->mem_glob; + size_t acc_size; + int ret; + +- acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct ttm_buffer_object)); +- ret = ttm_mem_global_alloc(mem_glob, acc_size, false, false); +- if (unlikely(ret != 0)) +- return ret; +- + bo = kzalloc(sizeof(*bo), GFP_KERNEL); +- +- if (unlikely(bo == NULL)) { +- ttm_mem_global_free(mem_glob, acc_size); ++ if (unlikely(bo == NULL)) + return -ENOMEM; +- } + ++ acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct ttm_buffer_object)); + ret = ttm_bo_init(bdev, bo, size, type, placement, page_alignment, + buffer_start, interruptible, + persistent_swap_storage, acc_size, NULL); diff --git a/queue-3.4/series b/queue-3.4/series index 372d11cb57a..6540bdae67f 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -11,3 +11,4 @@ x86-uv-fix-uv2-bau-legacy-mode.patch x86-mce-amd-make-apic-lvt-thresholding-interrupt-optional.patch hwrng-atmel-rng-fix-race-condition-leading-to-repeated-bits.patch crypto-aesni-intel-fix-unaligned-cbc-decrypt-for-x86-32.patch +drm-ttm-fix-buffer-object-metadata-accounting-regression-v2.patch -- 2.47.3