This is a note to let you know that I've just added the patch titled drm/msm: fix vram leak on bind errors to the 6.2-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: drm-msm-fix-vram-leak-on-bind-errors.patch and it can be found in the queue-6.2 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 60d476af96015891c7959f30838ae7a9749932bf Mon Sep 17 00:00:00 2001 From: Johan Hovold <johan+linaro@xxxxxxxxxx> Date: Mon, 6 Mar 2023 11:07:18 +0100 Subject: drm/msm: fix vram leak on bind errors From: Johan Hovold <johan+linaro@xxxxxxxxxx> commit 60d476af96015891c7959f30838ae7a9749932bf upstream. Make sure to release the VRAM buffer also in a case a subcomponent fails to bind. Fixes: d863f0c7b536 ("drm/msm: Call msm_init_vram before binding the gpu") Cc: stable@xxxxxxxxxxxxxxx # 5.11 Cc: Craig Tatlor <ctatlor97@xxxxxxxxx> Signed-off-by: Johan Hovold <johan+linaro@xxxxxxxxxx> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@xxxxxxxxxx> Patchwork: https://patchwork.freedesktop.org/patch/525094/ Link: https://lore.kernel.org/r/20230306100722.28485-7-johan+linaro@xxxxxxxxxx Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/gpu/drm/msm/msm_drv.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) --- a/drivers/gpu/drm/msm/msm_drv.c +++ b/drivers/gpu/drm/msm/msm_drv.c @@ -50,6 +50,8 @@ #define MSM_VERSION_MINOR 9 #define MSM_VERSION_PATCHLEVEL 0 +static void msm_deinit_vram(struct drm_device *ddev); + static const struct drm_mode_config_funcs mode_config_funcs = { .fb_create = msm_framebuffer_create, .output_poll_changed = drm_fb_helper_output_poll_changed, @@ -259,12 +261,7 @@ static int msm_drm_uninit(struct device if (kms && kms->funcs) kms->funcs->destroy(kms); - if (priv->vram.paddr) { - unsigned long attrs = DMA_ATTR_NO_KERNEL_MAPPING; - drm_mm_takedown(&priv->vram.mm); - dma_free_attrs(dev, priv->vram.size, NULL, - priv->vram.paddr, attrs); - } + msm_deinit_vram(ddev); component_unbind_all(dev, ddev); @@ -402,6 +399,19 @@ static int msm_init_vram(struct drm_devi return ret; } +static void msm_deinit_vram(struct drm_device *ddev) +{ + struct msm_drm_private *priv = ddev->dev_private; + unsigned long attrs = DMA_ATTR_NO_KERNEL_MAPPING; + + if (!priv->vram.paddr) + return; + + drm_mm_takedown(&priv->vram.mm); + dma_free_attrs(ddev->dev, priv->vram.size, NULL, priv->vram.paddr, + attrs); +} + static int msm_drm_init(struct device *dev, const struct drm_driver *drv) { struct msm_drm_private *priv = dev_get_drvdata(dev); @@ -448,7 +458,7 @@ static int msm_drm_init(struct device *d /* Bind all our sub-components: */ ret = component_bind_all(dev, ddev); if (ret) - goto err_put_dev; + goto err_deinit_vram; dma_set_max_seg_size(dev, UINT_MAX); @@ -546,6 +556,8 @@ err_msm_uninit: return ret; +err_deinit_vram: + msm_deinit_vram(ddev); err_put_dev: drm_dev_put(ddev); Patches currently in stable-queue which might be from johan+linaro@xxxxxxxxxx are queue-6.2/drm-msm-fix-vram-leak-on-bind-errors.patch queue-6.2/drm-msm-adreno-fix-runtime-pm-imbalance-at-gpu-load.patch queue-6.2/drm-msm-fix-workqueue-leak-on-bind-errors.patch queue-6.2/drm-msm-fix-drm-device-leak-on-bind-errors.patch queue-6.2/drm-msm-fix-missing-wq-allocation-error-handling.patch queue-6.2/drm-msm-fix-null-deref-on-irq-uninstall.patch queue-6.2/usb-dwc3-gadget-drop-dead-hibernation-code.patch queue-6.2/drm-msm-fix-null-deref-on-snapshot-tear-down.patch