From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj2-f10.google.com (mail-pj2-f10.google.com [74.125.227.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E1C483839B8 for ; Sat, 3 Oct 2026 09:35:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.227.138 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791020108; cv=none; b=UEs0PRHb+x3N6vKNZND8HAPYGnQa6FDbPpl8l/0ATitJDhQTLCMZEql4Jlv8kDj8ssFBLAd9bvFQfytnmNX+c0JaKT82d7exe/+VwQrp2oZG+nX16y9TnTlXl+X/Sy6s/at05o0gJSo9ZGBGkedK4q67ks3qPE5GOTI6BJ/cros= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791020108; c=relaxed/simple; bh=sMtTL70sqBS6bZKU54CdL/36q23iIjnTETx6pZYzH5s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=L9cvSqh56MQh+nuyQJ5lgJjbQ1ReNKPKfkotstdpaH+0ncdJlY+fHrdp1AGXX6+swTgr5xh5x5t+Peu+Qy+Rc/QNu7+FMppEKpPQx/iYZUMiYNoLSKDoM+tHBWRin9wje9V38o5raM67z+MCLsmBbPZV/vbK6e+sXqVRSIjcKmM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=hY3mMQpG; arc=none smtp.client-ip=74.125.227.138 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="hY3mMQpG" Received: by mail-pj2-f10.google.com with SMTP id d9443c01a7336-2dd9bce707bso1258605ad.1 for ; Sat, 03 Oct 2026 02:35:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791020104; x=1791624904; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=zWQSpGzLG7DWALbabuPoeKknlGH7FdAX1uCS5SSDZcY=; b=hY3mMQpG7FmLiUZINjqfWHoG08M6zQGeP4vRc1awwlkF4WqnT3iuwfBO3VBWlepzKS VkoiMNpXzT30bkM/NKdt+MsiniyZ/f+fOwLIMI5JijE9fEKhq5ZNaFLHH/FPYD4VNF0s MBMqca7rWkb6IdsMMIQ398um0m0zcPDJxFwQ0jt1nE8kjutdPPsqVLxg99z6vuG6r+8A grWfu6/psy2xiyk8/+I/GM3pBYXRACHipUZ+Y6CDi094PuWTShDEJ2e8kZfZTgV7RljI VIER3S4j3cDS549gXB6s5bEVVQVVk1vTcLwnsbuRLQj59iFIOZs/U6LKvpV7Yzv7PMe/ rYzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791020104; x=1791624904; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=zWQSpGzLG7DWALbabuPoeKknlGH7FdAX1uCS5SSDZcY=; b=Tgb4/KxjfAG/d53zFzxdPFVR/mQaAe40lU2SaYsAVtXvas/QBpz0m4GrJw07gmSWn7 iLeLj4XgehwL5TOFueZxAAgEcMVQLIHsRl5td4E/UiELY94Gy7/AD4P1vbm2QlZxNR0t fIsy6eDkZuEj0hToB6eNLfwU7YCTuLsUsAp/4Tkh5mDu1YHAJtffyj3vi1VqgxBhL56+ G49oJWZIT5SNj0f0l+oP9bVeDUcjTJQ3s1a3xz3inGo/Ac0bWTAVNZPfyAaBndOTzh3P /LC8WhrfyXHA0g8wwje9iyY67brAMKikTbRYxdDEWDjnRO3Uyko4dzfVYomXmpn4zh5O 3X3g== X-Forwarded-Encrypted: i=1; AKwUvBwUfyms6ALTUBULmZKWssZxL262zlO/KyvEAua2oWtF/V3FppappsY4fQJyFDDAQR9X1NPtT13W7uiiwls=@vger.kernel.org X-Gm-Message-State: AFuF++lGg9CE9RgLchIxHpCQx+2e8GQiw8f7dShF5BgCSvLfHW5mZ1F0 PCToQTahDlm4gEty8PqmHugYMZVTheAi2B4Fisvg9/gLofkVnRu+Wzoj X-Gm-Gg: AYBFou1ipD7U2vhBQmAb+Skfjy1OHmDQqRFK+Fqn/tnMsOJb7l9WZkbYPVO1fMKTH/U tJ1Vdp6ZU40sUlhgGInpMoGbQZdVbs9nXZUkGZFHgHu9H6aXpQlFkoaMyjfyRKZVBqrh2Qytdsc i9WrEXRz+ppD8vP5A1VO02ADSmyuSqlrXC2rbkPDTZaFlwlPzdYkMDY87zTw81IoJj1/Xo6SGYS Pmw8ND3HDHE2Zc1jXfMO4xZmPe0P2eav77DE+6VJwPhMBk38p+fWZkNdXoPW2c9uxiHRjpDDv/d hXkE0BGQMhVnfj5zJUqYI6ceW//fQfa2zzQEUQfnKi+8DlbsMFJeqCFkizRHfrvUL7e7FCo9kvv pC9InNXMIorhaXjnn+n23Ly0LU2+po+HCjGYDv76j6Sgifldufpz6vPnpY6lPtpDTgQ3RIJmNaU brDuRxZqEEB29bjUkqcLRmbNOt2GOAkLrw6qFf/voPnCgyuY+oEnDqVhOadS+SsE5B X-Received: by 2002:a05:6a20:94ca:b0:3e0:b680:c3cd with SMTP id adf61e73a8af0-3e0bd2900d8mr5555662637.49.1791020104397; Sat, 03 Oct 2026 02:35:04 -0700 (PDT) Received: from localhost ([129.227.235.110]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cc9f739cba5sm1956261a12.28.2026.10.03.02.35.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Oct 2026 02:35:03 -0700 (PDT) From: Evanshenf To: dri-devel@lists.freedesktop.org Cc: Jianmin Lv , Qianhai Wu , Huacai Chen , Mingcong Bai , Xi Ruoyao , Icenowy Zheng , Sui Jingfeng , stable@vger.kernel.org, linux-kernel@vger.kernel.org, Evanshenf Subject: [PATCH 2/2] drm/loongson: Handle buffer mapping failures when clearing a BO Date: Sat, 3 Oct 2026 09:34:59 +0000 Message-ID: <20261003093415.902f89244043-2-archwse@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261003093415.e64386de1e64-1-archwse@gmail.com> References: <20261003093415.e64386de1e64-1-archwse@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit lsdc_bo_clear() ignores the return value from lsdc_bo_kmap() and writes to lbo->kptr unconditionally. When the first mapping of a newly allocated buffer fails, kptr is still NULL and the subsequent memset accesses it. Return the mapping error without touching the buffer and propagate it from lsdc_gem_object_create(). Install the GEM object functions before clearing so that drm_gem_object_put() can release the buffer correctly on failure. Do not add the failed object to the tracking list or return an uncleared buffer to the caller. Imported buffers still skip clearing, and successfully mapped buffers are cleared and unmapped as before. Tested on LS7A2000 with a one-shot range error in ttm_bo_kmap(). Its -EINVAL return reached userspace, the object was destroyed once, and no GEM handle was published. Normal create/map/zero/write/read/close cycles passed, with the tracked BO count and VRAM usage unchanged. AI assistance was used for the lifetime analysis, fix, fault-injection tools, build and test execution. Fixes: f39db26c5428 ("drm: Add kms driver for loongson display controller") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Evanshenf --- drivers/gpu/drm/loongson/lsdc_gem.c | 12 ++++++++---- drivers/gpu/drm/loongson/lsdc_ttm.c | 10 ++++++++-- drivers/gpu/drm/loongson/lsdc_ttm.h | 2 +- 3 files changed, 17 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/loongson/lsdc_gem.c b/drivers/gpu/drm/loongson/lsdc_gem.c index 2fb0348..9eba4e1 100644 --- a/drivers/gpu/drm/loongson/lsdc_gem.c +++ b/drivers/gpu/drm/loongson/lsdc_gem.c @@ -157,14 +157,18 @@ struct drm_gem_object *lsdc_gem_object_create(struct drm_device *ddev, return ERR_PTR(ret); } + gobj = &lbo->tbo.base; + gobj->funcs = &lsdc_gem_object_funcs; + if (!sg) { /* VRAM is filled with random data */ - lsdc_bo_clear(lbo); + ret = lsdc_bo_clear(lbo); + if (ret) { + drm_gem_object_put(gobj); + return ERR_PTR(ret); + } } - gobj = &lbo->tbo.base; - gobj->funcs = &lsdc_gem_object_funcs; - /* tracking the BOs we created */ mutex_lock(&ldev->gem.mutex); list_add_tail(&lbo->list, &ldev->gem.objects); diff --git a/drivers/gpu/drm/loongson/lsdc_ttm.c b/drivers/gpu/drm/loongson/lsdc_ttm.c index 88536e2..7b30dea 100644 --- a/drivers/gpu/drm/loongson/lsdc_ttm.c +++ b/drivers/gpu/drm/loongson/lsdc_ttm.c @@ -388,9 +388,13 @@ void lsdc_bo_kunmap(struct lsdc_bo *lbo) ttm_bo_kunmap(&lbo->kmap); } -void lsdc_bo_clear(struct lsdc_bo *lbo) +int lsdc_bo_clear(struct lsdc_bo *lbo) { - lsdc_bo_kmap(lbo); + int ret; + + ret = lsdc_bo_kmap(lbo); + if (ret) + return ret; if (lbo->is_iomem) memset_io((void __iomem *)lbo->kptr, 0, lbo->size); @@ -398,6 +402,8 @@ void lsdc_bo_clear(struct lsdc_bo *lbo) memset(lbo->kptr, 0, lbo->size); lsdc_bo_kunmap(lbo); + + return 0; } int lsdc_bo_evict_vram(struct drm_device *ddev) diff --git a/drivers/gpu/drm/loongson/lsdc_ttm.h b/drivers/gpu/drm/loongson/lsdc_ttm.h index 843e147..df47d9b 100644 --- a/drivers/gpu/drm/loongson/lsdc_ttm.h +++ b/drivers/gpu/drm/loongson/lsdc_ttm.h @@ -89,7 +89,7 @@ size_t lsdc_bo_size(struct lsdc_bo *lbo); int lsdc_bo_kmap(struct lsdc_bo *lbo); void lsdc_bo_kunmap(struct lsdc_bo *lbo); -void lsdc_bo_clear(struct lsdc_bo *lbo); +int lsdc_bo_clear(struct lsdc_bo *lbo); int lsdc_bo_evict_vram(struct drm_device *ddev); -- 2.43.0