diff options
| author | Rob Clark <robdclark@chromium.org> | 2023-07-12 15:25:23 -0700 |
|---|---|---|
| committer | Rob Clark <robdclark@chromium.org> | 2023-07-17 12:54:20 -0700 |
| commit | 1cd0787f082e1a179f2b6e749d08daff1a9f6b1b (patch) | |
| tree | 68257b224fd1f8430475789a12e2bd3e76a52993 /drivers/gpu/drm/msm/msm_fence.c | |
| parent | 6e8a996563ecbe68e49c49abd4aaeef69f11f2dc (diff) | |
| download | linux-1cd0787f082e1a179f2b6e749d08daff1a9f6b1b.tar.gz linux-1cd0787f082e1a179f2b6e749d08daff1a9f6b1b.tar.bz2 linux-1cd0787f082e1a179f2b6e749d08daff1a9f6b1b.zip | |
drm/msm: Fix hw_fence error path cleanup
In an error path where the submit is free'd without the job being run,
the hw_fence pointer is simply a kzalloc'd block of memory. In this
case we should just kfree() it, rather than trying to decrement it's
reference count. Fortunately we can tell that this is the case by
checking for a zero refcount, since if the job was run, the submit would
be holding a reference to the hw_fence.
Fixes: f94e6a51e17c ("drm/msm: Pre-allocate hw_fence")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Patchwork: https://patchwork.freedesktop.org/patch/547088/
Diffstat (limited to 'drivers/gpu/drm/msm/msm_fence.c')
| -rw-r--r-- | drivers/gpu/drm/msm/msm_fence.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/gpu/drm/msm/msm_fence.c b/drivers/gpu/drm/msm/msm_fence.c index 96599ec3eb78..1a5d4f1c8b42 100644 --- a/drivers/gpu/drm/msm/msm_fence.c +++ b/drivers/gpu/drm/msm/msm_fence.c @@ -191,6 +191,12 @@ msm_fence_init(struct dma_fence *fence, struct msm_fence_context *fctx) f->fctx = fctx; + /* + * Until this point, the fence was just some pre-allocated memory, + * no-one should have taken a reference to it yet. + */ + WARN_ON(kref_read(&fence->refcount)); + dma_fence_init(&f->base, &msm_fence_ops, &fctx->spinlock, fctx->context, ++fctx->last_fence); } |