/*
* Copyright (c) 2016, The Linux Foundation. All rights reserved.
*
* This software is licensed under the terms of the GNU General Public
* License version 2, as published by the Free Software Foundation, and
* may be copied, distributed, and modified under those terms.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*/
#ifndef _DT_BINDINGS_CLK_MSM_GCC_8994_H
#define _DT_BINDINGS_CLK_MSM_GCC_8994_H
#define GPLL0_EARLY 0
#define GPLL0 1
#define GPLL4_EARLY 2
#define GPLL4 3
#define UFS_AXI_CLK_SRC 4
#define USB30_MASTER_CLK_SRC 5
#define BLSP1_QUP1_I2C_APPS_CLK_SRC 6
#define BLSP1_QUP1_SPI_APPS_CLK_SRC 7
#define BLSP1_QUP2_I2C_APPS_CLK_SRC 8
#define BLSP1_QUP2_SPI_APPS_CLK_SRC 9
#define BLSP1_QUP3_I2C_APPS_CLK_SRC 10
#define BLSP1_QUP3_SPI_APPS_CLK_SRC 11
#define BLSP1_QUP4_I2C_APPS_CLK_SRC 12
#define BLSP1_QUP4_SPI_APPS_CLK_SRC 13
#define BLSP1_QUP5_I2C_APPS_CLK_SRC 14
#define BLSP1_QUP5_SPI_APPS_CLK_SRC 15
#define BLSP1_QUP6_I2C_APPS_CLK_SRC 16
#define BLSP1_QUP6_SPI_APPS_CLK_SRC 17
#define BLSP1_UART1_APPS_CLK_SRC 18
#define BLSP1_UART2_APPS_CLK_SRC 19
#define BLSP1_UART3_APPS_CLK_SRC 20
#define BLSP1_UART4_APPS_CLK_SRC 21
#define BLSP1_UART5_APPS_CLK_SRC 22
#define BLSP1_UART6_APPS_CLK_SRC 23
#define BLSP2_QUP1_I2C_APPS_CLK_SRC 24
#define BLSP2_QUP1_SPI_APPS_CLK_SRC 25
#define BLSP2_QUP2_I2C_APPS_CLK_SRC 26
#define BLSP2_QUP2_SPI_APPS_CLK_SRC 27
#define BLSP2_QUP3_I2C_APPS_CLK_SRC 28
#define BLSP2_QUP3_SPI_APPS_CLK_SRC 29
#define BLSP2_QUP4_I2C_APPS_CLK_SRC 30
#define BLSP2_QUP4_SPI_APPS_CLK_SRC 31
#define BLSP2_QUP5_I2C_APPS_CLK_SRC 32
#define BLSP2_QUP5_SPI_APPS_CLK_SRC 33
#define BLSP2_QUP6_I2C_APPS_CLK_SRC 34
#define BLSP2_QUP6_SPI_APPS_CLK_SRC 35
#define BLSP2_UART1_APPS_CLK_SRC 36
#define BLSP2_UART2_APPS_CLK_SRC 37
#define BLSP2_UART3_APPS_CLK_SRC 38
#define BLSP2_UART4_APPS_CLK_SRC 39
#define BLSP2_UART5_APPS_CLK_SRC 40
#define BLSP2_UART6_APPS_CLK_SRC 41
#define GP1_CLK_SRC 42
#define GP2_CLK_SRC 43
#define GP3_CLK_SRC 44
#define PCIE_0_AUX_CLK_SRC 45
#define PCIE_0_PIPE_CLK_SRC 46
#define PCIE_1_AUX_CLK_SRC 47
#define PCIE_1_PIPE_CLK_SRC 48
#define PDM2_CLK_SRC 49
#define SDCC1_APPS_CLK_SRC 50
#define SDCC2_APPS_CLK_SRC 51
#define SDCC3_APPS_CLK_SRC 52
#define SDCC4_APPS_CLK_SRC 53
#define TSIF_REF_CLK_SRC 54
#define USB30_MOCK_UTMI_CLK_SRC 55
#define USB3_PHY_AUX_CLK_SRC 56
#define USB_HS_SYSTEM_CLK_SRC 57
#define GCC_BLSP1_AHB_CLK 58
#define GCC_BLSP1_QUP1_I2C_APPS_CLK 59
#define GCC_BLSP1_QUP1_SPI_APPS_CLK 60
#define GCC_BLSP1_QUP2_I2C_APPS_CLK 61
#define GCC_BLSP1_QUP2_SPI_APPS_CLK 62
#define GCC_BLSP1_QUP3_I2C_APPS_CLK 63
#define GCC_BLSP1_QUP3_SPI_APPS_CLK 64
#define GCC_BLSP1_QUP4_I2C_APPS_CLK 65
#define GCC_BLSP1_QUP4_SPI_APPS_CLK 66
#define GCC_BLSP1_QUP5_I2C_APPS_CLK 67
#define GCC_BLSP1_QUP5_SPI_APPS_CLK 68
#define GCC_BLSP1_QUP6_I2C_APPS_CLK 69
#define GCC_BLSP1_QUP6_SPI_APPS_CLK 70
#define GCC_BLSP1_UART1_APPS_CLK 71
#define GCC_BLSP1_UART2_APPS_CLK 72
#define GCC_BLSP1_UART3_APPS_CLK 73
#define GCC_BLSP1_UART4_APPS_CLK 74
#define GCC_BLSP1_UART5_APPS_CLK 75
#define GCC_BLSP1_UART6_APPS_CLK 76
#define GCC_BLSP2_AHB_CLK 77
#define GCC_BLSP2_QUP1_I2C_APPS_CLK 78
#define GCC_BLSP2_QUP1_SPI_APPS_CLK 79
#define GCC_BLSP2_QUP2_I2C_APPS_CLK 80
#define GCC_BLSP2_QUP2_SPI_APPS_CLK 81
#define GCC_BLSP2_QUP3_I2C_APPS_CLK 82
#define GCC_BLSP2_QUP3_SPI_APPS_CLK 83
#define GCC_BLSP2_QUP4_I2C_APPS_CLK 84
#define GCC_BLSP2_QUP4_SPI_APPS_CLK 85
#define GCC_BLSP2_QUP5_I2C_APPS_CLK 86
#define GCC_BLSP2_QUP5_SPI_APPS_CLK 87
#define GCC_BLSP2_QUP6_I2C_APPS_CLK 88
#define GCC_BLSP2_QUP6_SPI_APPS_CLK 89
#define GCC_BLSP2_UART1_APPS_CLK 90
#define GCC_BLSP2_UART2_APPS_CLK 91
#define GCC_BLSP2_UART3_APPS_CLK 92
#define GCC_BLSP2_UART4_APPS_CLK 93
#define GCC_BLSP2_UART5_APPS_CLK 94
#define GCC_BLSP2_UART6_APPS_CLK 95
#define GCC_GP1_CLK 96
#define GCC_GP2_CLK 97
#define GCC_GP3_CLK 98
#define GCC_PCIE_0_AUX_CLK 99
#define GCC_PCIE_0_PIPE_CLK 100
#define GCC_PCIE_1_AUX_CLK 101
#define GCC_PCIE_1_PIPE_CLK 102
#define GCC_PDM2_CLK 103
#define GCC_SDCC1_APPS_CLK 104
#define GCC_SDCC2_APPS_CLK 105
#define GCC_SDCC3_APPS_CLK 106
#define GCC_SDCC4_APPS_CLK 107
#define GCC_SYS_NOC_UFS_AXI_CLK 108
#define GCC_SYS_NOC_USB3_AXI_CLK 109
#define GCC_TSIF_REF_CLK 110
#define GCC_UFS_AXI_CLK 111
#define GCC_UFS_RX_CFG_CLK 112
#define GCC_UFS_TX_CFG_CLK 113
#define GCC_USB30_MASTER_CLK 114
#define GCC_USB30_MOCK_UTMI_CLK 115
#define GCC_USB3_PHY_AUX_CLK 116
#define GCC_USB_HS_SYSTEM_CLK 117
#endif
it/commit/net/sunrpc/xprtrdma?id=92c715fca907686f5298220ece53423e38ba3aed'>92c715fca907686f5298220ece53423e38ba3aed (patch)
| tree | 286158fdad04c9b54955350abb95d4f1c0dc860a /net/sunrpc/xprtrdma |
|---|
| parent | e6e7b48b295afa5a5ab440de0a94d9ad8b3ce2d0 (diff) |
|---|
drm/atomic: Fix double free in drm_atomic_state_default_clear
drm_atomic_helper_page_flip and drm_atomic_ioctl set their own events
in crtc_state->event. But when it's set the event is freed in 2 places.
Solve this by only freeing the event in the atomic ioctl when it
allocated its own event.
This has been broken twice. The first time when the code was introduced,
but only in the corner case when an event is allocated, but more crtc's
were included by atomic check and then failing. This can mostly
happen when you do an atomic modeset in i915 and the display clock is
changed, which forces all crtc's to be included to the state.
This has been broken worse by adding in-fences support, which caused
the double free to be done unconditionally.
[IGT] kms_rotation_crc: starting subtest primary-rotation-180
=============================================================================
BUG kmalloc-128 (Tainted: G U ): Object already free
-----------------------------------------------------------------------------
Disabling lock debugging due to kernel taint
INFO: Allocated in drm_atomic_helper_setup_commit+0x285/0x2f0 [drm_kms_helper] age=0 cpu=3 pid=1529
___slab_alloc+0x308/0x3b0
__slab_alloc+0xd/0x20
kmem_cache_alloc_trace+0x92/0x1c0
drm_atomic_helper_setup_commit+0x285/0x2f0 [drm_kms_helper]
intel_atomic_commit+0x35/0x4f0 [i915]
drm_atomic_commit+0x46/0x50 [drm]
drm_mode_atomic_ioctl+0x7d4/0xab0 [drm]
drm_ioctl+0x2b3/0x490 [drm]
do_vfs_ioctl+0x69c/0x700
SyS_ioctl+0x4e/0x80
entry_SYSCALL_64_fastpath+0x13/0x94
INFO: Freed in drm_event_cancel_free+0xa3/0xb0 [drm] age=0 cpu=3 pid=1529
__slab_free+0x48/0x2e0
kfree+0x159/0x1a0
drm_event_cancel_free+0xa3/0xb0 [drm]
drm_mode_atomic_ioctl+0x86d/0xab0 [drm]
drm_ioctl+0x2b3/0x490 [drm]
do_vfs_ioctl+0x69c/0x700
SyS_ioctl+0x4e/0x80
entry_SYSCALL_64_fastpath+0x13/0x94
INFO: Slab 0xffffde1f0997b080 objects=17 used=2 fp=0xffff92fb65ec2578 flags=0x200000000008101
INFO: Object 0xffff92fb65ec2578 @offset=1400 fp=0xffff92fb65ec2ae8
Redzone ffff92fb65ec2570: bb bb bb bb bb bb bb bb ........
Object ffff92fb65ec2578: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object ffff92fb65ec2588: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object ffff92fb65ec2598: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object ffff92fb65ec25a8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object ffff92fb65ec25b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object ffff92fb65ec25c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object ffff92fb65ec25d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object ffff92fb65ec25e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk.
Redzone ffff92fb65ec25f8: bb bb bb bb bb bb bb bb ........
Padding ffff92fb65ec2738: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
CPU: 3 PID: 180 Comm: kworker/3:2 Tainted: G BU 4.10.0-rc6-patser+ #5039
Hardware name: /NUC5PPYB, BIOS PYBSWCEL.86A.0031.2015.0601.1712 06/01/2015
Workqueue: events intel_atomic_helper_free_state [i915]
Call Trace:
dump_stack+0x4d/0x6d
print_trailer+0x20c/0x220
free_debug_processing+0x1c6/0x330
? drm_atomic_state_default_clear+0xf7/0x1c0 [drm]
__slab_free+0x48/0x2e0
? drm_atomic_state_default_clear+0xf7/0x1c0 [drm]
kfree+0x159/0x1a0
drm_atomic_state_default_clear+0xf7/0x1c0 [drm]
? drm_atomic_state_clear+0x30/0x30 [drm]
intel_atomic_state_clear+0xd/0x20 [i915]
drm_atomic_state_clear+0x1a/0x30 [drm]
__drm_atomic_state_free+0x13/0x60 [drm]
intel_atomic_helper_free_state+0x5d/0x70 [i915]
process_one_work+0x260/0x4a0
worker_thread+0x2d1/0x4f0
kthread+0x127/0x130
? process_one_work+0x4a0/0x4a0
? kthread_stop+0x120/0x120
ret_from_fork+0x29/0x40
FIX kmalloc-128: Object at 0xffff92fb65ec2578 not freed
Fixes: 3b24f7d67581 ("drm/atomic: Add struct drm_crtc_commit to track async updates")
Fixes: 9626014258a5 ("drm/fence: add in-fences support")
Cc: <stable@vger.kernel.org> # v4.8+
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Gustavo Padovan <gustavo.padovan@collabora.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1485854725-27640-1-git-send-email-maarten.lankhorst@linux.intel.com