linux-kernel - Re: [PATCH] drm/ttm: fix error handling in ttm_bo_handle_move

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <03d0b798-d1ab-5b6f-2c27-8140d923d445@gmail.com>
Date:   Wed, 16 Jun 2021 08:46:33 +0200
From:   Christian König <ckoenig.leichtzumerken@...il.com>
To:     Dan Carpenter <dan.carpenter@...cle.com>,
        Thomas Hellstr <C3@...nda>, B6@...nda,
        m <thomas.hellstrom@...ux.intel.com>
Cc:     Huang Rui <ray.huang@....com>, David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/ttm: fix error handling in ttm_bo_handle_move_mem()

Sending the first message didn't worked, so let's try again.

Am 16.06.21 um 08:30 schrieb Dan Carpenter:
> There are three bugs here:
> 1) We need to call unpopulate() if ttm_tt_populate() succeeds.
> 2) The "new_man = ttm_manager_type(bdev, bo->mem.mem_type);" assignment
>     was wrong and it was really assigning "new_mem = old_mem;".  There
>     is no need for this assignment anyway as we already have the value
>     for "new_mem".
> 3) The (!new_man->use_tt) condition is reversed.
>
> Fixes: ba4e7d973dd0 ("drm: Add the TTM GPU memory manager subsystem.")
> Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
> ---
> This is from reading the code and I can't swear that I have understood
> it correctly.  My nouveau driver is currently unusable and this patch
> has not helped.  But hopefully if I fix enough bugs eventually it will
> start to work.

Well NAK, the code previously looked quite well and you are breaking it now.

What's the problem with nouveau?

>   drivers/gpu/drm/ttm/ttm_bo.c | 14 ++++++++------
>   1 file changed, 8 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> index ebcffe794adb..72dde093f754 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> @@ -180,12 +180,12 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
>   		 */
>   		ret = ttm_tt_create(bo, old_man->use_tt);
>   		if (ret)
> -			goto out_err;
> +			return ret;
>   
>   		if (mem->mem_type != TTM_PL_SYSTEM) {
>   			ret = ttm_tt_populate(bo->bdev, bo->ttm, ctx);
>   			if (ret)
> -				goto out_err;
> +				goto err_destroy;
>   		}
>   	}
>   
> @@ -193,15 +193,17 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
>   	if (ret) {
>   		if (ret == -EMULTIHOP)
>   			return ret;
> -		goto out_err;
> +		goto err_unpopulate;
>   	}
>   
>   	ctx->bytes_moved += bo->base.size;
>   	return 0;
>   
> -out_err:
> -	new_man = ttm_manager_type(bdev, bo->mem.mem_type);

This here switches new and old manager. E.g. the new_man is now pointing 
to the existing resource manager.

> -	if (!new_man->use_tt)

So we should destroy the TT object only if the old manager is not using one.

> +err_unpopulate:
> +	if (new_man->use_tt)
> +		ttm_tt_unpopulate(bo->bdev, bo->ttm);

Unpopulate is not necessary, destroying is sufficient.

Christian.

> +err_destroy:
> +	if (new_man->use_tt)
>   		ttm_bo_tt_destroy(bo);
>   
>   	return ret;