From f72adfb7708aef62fa3539648d44114361d5d382 Mon Sep 17 00:00:00 2001 From: Sandy Huang Date: Tue, 6 Mar 2018 11:13:55 +0800 Subject: [PATCH] drm/rockchip: vop: fix out of memory when calc bandwidth bug log: [ 21.432332] Internal error: Accessing user space memory outside uaccess.h routines: 96000005 [#1] PREEMPT SMP [ 21.433228] Modules linked in: [ 21.433530] CPU: 3 PID: 716 Comm: ndroid.settings Not tainted 4.4.83 #121 [ 21.434130] Hardware name: Rockchip RK3399 Excavator Board edp (Android) (DT) [ 21.434768] task: ffffffc0cd63e800 task.stack: ffffffc0cd630000 [ 21.435304] PC is at kmem_cache_alloc_trace+0xa8/0x204 [ 21.435776] LR is at binder_transaction+0x58c/0x1c44 ...... [ 21.572340] [] kmem_cache_alloc_trace+0xa8/0x204 [ 21.572890] [] binder_transaction+0x58c/0x1c44 [ 21.573424] [] binder_thread_write+0xa44/0x136c [ 21.573968] [] binder_ioctl_write_read+0xe0/0x314 [ 21.574523] [] binder_ioctl+0x1d0/0x668 [ 21.575010] [] do_vfs_ioctl+0x5e4/0x720 [ 21.575494] [] SyS_ioctl+0x60/0x88 [ 21.575936] [] el0_svc_naked+0x24/0x28 or: [ 549.171031] Internal error: Accessing user space memory outside uaccess.h routines: 96000005 [#1] PREEMPT SMP [ 549.171920] Modules linked in: [ 549.172213] CPU: 2 PID: 2575 Comm: surfaceflinger Not tainted 4.4.83 #121 [ 549.172810] Hardware name: Rockchip RK3399 Excavator Board edp (Android) (DT) [ 549.173444] task: ffffffc0b851a700 task.stack: ffffffc0b2a40000 [ 549.173973] PC is at kmem_cache_alloc_trace+0xa8/0x204 [ 549.174437] LR is at drm_flip_work_allocate_task+0x2c/0x4c [ 549.174920] pc : [] lr : [] pstate: 60400145 ...... [ 549.285299] [] kmem_cache_alloc_trace+0xa8/0x204 [ 549.285845] [] drm_flip_work_allocate_task+0x2c/0x4c [ 549.286422] [] drm_flip_work_queue+0x38/0xa4 [ 549.286942] [] vop_crtc_atomic_flush+0x1f48/0x2274 [ 549.287509] [] drm_atomic_helper_commit_planes+0x194/0x1bc [ 549.288136] [] rockchip_atomic_commit_complete+0x58/0xa0 [ 549.288750] [] rockchip_drm_atomic_commit+0x184/0x1a4 [ 549.289340] [] drm_atomic_commit+0x64/0x70 [ 549.289848] [] drm_mode_atomic_ioctl+0x4fc/0x604 [ 549.290393] [] drm_ioctl+0x278/0x3f8 [ 549.290856] [] do_vfs_ioctl+0x5e4/0x720 [ 549.291339] [] SyS_ioctl+0x60/0x88 [ 549.291778] [] el0_svc_naked+0x24/0x28 Change-Id: I101c7dfa881611f3ca9225542e767897efe8fc1d Signed-off-by: Sandy Huang --- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c index 6d3bf55c4351..8f1dd2df5f11 100644 --- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c @@ -2232,19 +2232,22 @@ static size_t vop_crtc_bandwidth(struct drm_crtc *crtc, u16 htotal = adjusted_mode->crtc_htotal; u16 vdisplay = adjusted_mode->crtc_vdisplay; int clock = adjusted_mode->crtc_clock; - struct vop *vop = to_vop(crtc); - const struct vop_data *vop_data = vop->data; struct vop_plane_state *vop_plane_state; struct drm_plane_state *pstate; struct vop_bandwidth *pbandwidth; struct drm_plane *plane; u64 bandwidth; - int i, cnt = 0; + int i, cnt = 0, plane_num = 0; if (!htotal || !vdisplay) return 0; - pbandwidth = kmalloc_array(vop_data->win_size, sizeof(*pbandwidth), + for_each_plane_in_state(state, plane, pstate, i) { + if (pstate->crtc != crtc || !pstate->fb) + continue; + plane_num++; + } + pbandwidth = kmalloc_array(plane_num, sizeof(*pbandwidth), GFP_KERNEL); if (!pbandwidth) return -ENOMEM;