github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-12 20:54:48 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
df72e55e75
linux/drivers/gpu/drm
History
Matthew Brost df72e55e75 drm/pagemap: Fix folio allocation fallback and use-after-put 
drm_pagemap_migrate_populate_ram_pfn() had two issues when populating
RAM PFNs with higher-order folios:

1. The higher-order vma_alloc_folio()/folio_alloc() calls did not pass
   __GFP_NOWARN, so a THP allocation failure under memory pressure
   would spam the kernel log, and there was no fallback path despite a
   TODO comment stating one was needed. Add __GFP_NOWARN to the
   higher-order allocation and, on failure, fall back to order-0
   allocations for the entire range originally covered by the failed
   higher-order allocation, leaving MIGRATE_PFN_COMPOUND unset for
   those PFNs.

2. In the free_pages error path, order was computed via
   folio_order(page_folio(page)) *after* put_page(page) had already
   dropped the reference, resulting in a use-after-free/put when that
   was the last reference on the page. Compute order before releasing
   the page.

Introducing the fallback in 1. also requires the source page array
handed to ->copy_to_ram() to be built differently. Both callers only
populated the entry at the head of each source folio, relying on the
copy callback to derive the rest of the folio from the order recorded
in the matching drm_pagemap_addr. Once the destination has been demoted
to order-0 folios the drm_pagemap_addr entries are per-page, so a source
page is needed for every one of them; leaving them NULL makes the copy
callback stop after the first page and the remainder of the range is
never copied.

The source folio is only split later, by migrate_vma_pages() /
migrate_device_pages(), so its order cannot be used to detect the
demotion - test the destination for MIGRATE_PFN_COMPOUND instead. Factor
the array population out into drm_pagemap_migrate_populate_src_pages()
and use it from both drm_pagemap_evict_to_ram() and
__drm_pagemap_migrate_to_ram().

Fixes: ddeda61360 ("drm/pagemap: Allocate folios when possible")
Cc: stable@vger.kernel.org
Assisted-by: GitHub_Copilot:claude-opus-5
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Link: https://patch.msgid.link/20260902063504.3024362-2-matthew.brost@intel.com
2026-09-02 12:25:32 -07:00
..
adp drm/adp: mipi: Add atomic bridge state handlers 2026-07-15 09:45:46 +02:00
amd drm/amd/display: advertise PIXEL_NONE and PREMULTI blend mode for DCE 2026-09-02 15:42:25 -03:00
arm drm/arm/komeda: fix error handling for clk_prepare_enable() and callers 2026-06-30 15:26:54 +01:00
armada drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
aspeed Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ast drm-misc-next for v7.1-rc1: 2026-05-06 10:12:25 +10:00
atmel-hlcdc drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
bridge Linux 7.2 2026-08-20 10:58:44 +10:00
ci hwrng: qcom - Move qcom-rng.c into drivers/char/hw_random/ 2026-07-05 13:22:35 +08:00
clients Linux 7.2 2026-08-20 10:58:44 +10:00
display Linux 7.2 2026-08-20 10:58:44 +10:00
etnaviv drm for 7.3-rc1 2026-08-21 08:41:00 -07:00
exynos drm for 7.3-rc1 2026-08-21 08:41:00 -07:00
fsl-dcu drm/panel: of_drm_find_panel() return a counted reference 2026-07-20 15:07:22 +02:00
gma500 drm for 7.3-rc1 2026-08-21 08:41:00 -07:00
gud drm/gud: validate GUD_ROTATION_0 is present in supported rotations 2026-08-23 17:35:13 +01:00
hisilicon drm-misc-next for 7.3: 2026-07-07 09:34:04 +10:00
hyperv drm/hyperv: Move MODULE_DEVICE_TABLE to the device_id arrays 2026-07-20 10:33:49 -04:00
i915 mm.git review status for linus..mm-stable 2026-08-27 09:17:06 -07:00
imagination power sequencing updates for v7.3-rc1 2026-08-26 08:45:09 -07:00
imx drm: fix missing header include for drm_panel_put() 2026-07-22 13:50:27 +02:00
ingenic drm/panel: of_drm_find_panel() return a counted reference 2026-07-20 15:07:22 +02:00
kmb drm-misc-next for v7.2-rc1: 2026-05-08 14:16:04 +10:00
lima Linux 7.2 2026-08-20 10:58:44 +10:00
logicvc drm/panel: of_drm_find_panel() return a counted reference 2026-07-20 15:07:22 +02:00
loongson drm: Consistently define pci_device_ids using named initializers 2026-06-17 11:07:01 +02:00
mcde drm/panel: of_drm_find_panel() return a counted reference 2026-07-20 15:07:22 +02:00
mediatek Linux 7.2 2026-08-20 10:58:44 +10:00
meson drm-misc-next for 7.3: 2026-07-07 09:34:04 +10:00
mgag200 drm: Consistently define pci_device_ids using named initializers 2026-06-17 11:07:01 +02:00
msm drm next/fixes for 7.3-rc1 2026-08-28 16:37:55 -07:00
mxsfb drm: fix missing header include for drm_panel_put() 2026-07-22 13:50:27 +02:00
nouveau drm/nouveau: Use write-combined maps for coherent 2026-09-01 22:05:10 +02:00
nova drm for 7.3-rc1 2026-08-21 08:41:00 -07:00
omapdrm drm for 7.3-rc1 2026-08-21 08:41:00 -07:00
panel Linux 7.2 2026-08-20 10:58:44 +10:00
panfrost Linux 7.2 2026-08-20 10:58:44 +10:00
panthor mm.git review status for linus..mm-stable 2026-08-27 09:17:06 -07:00
pl111 drm/panel: of_drm_find_panel() return a counted reference 2026-07-20 15:07:22 +02:00
qxl drm/qxl: remove dependency on DRM simple helpers 2026-07-10 15:08:57 +02:00
radeon drm/radeon: fix internal display on iMac11, 1 (RV770/DCE3.1) 2026-08-19 10:12:25 -04:00
renesas drm/panel: of_drm_find_panel() return a counted reference 2026-07-20 15:07:22 +02:00
rockchip drm for 7.3-rc1 2026-08-21 08:41:00 -07:00
scheduler Linux 7.2 2026-08-20 10:58:44 +10:00
sitronix drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
solomon drm/ssd130x: Add per-family update backlight logic 2026-08-06 14:55:55 +02:00
sprd Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
sti drm/panel: of_drm_find_panel() return a counted reference 2026-07-20 15:07:22 +02:00
stm drm: fix missing header include for drm_panel_put() 2026-07-22 13:50:27 +02:00
sun4i drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz 2026-08-06 14:22:50 +08:00
sysfb Merge drm/drm-fixes into drm-misc-fixes 2026-09-01 09:38:51 +02:00
tegra Merge drm/drm-fixes into drm-misc-fixes 2026-09-01 09:38:51 +02:00
tests Linux 7.2 2026-08-20 10:58:44 +10:00
tidss drm/panel: of_drm_find_panel() return a counted reference 2026-07-20 15:07:22 +02:00
tilcdc Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
tiny Merge drm/drm-fixes into drm-misc-fixes 2026-09-01 09:38:51 +02:00
ttm mm.git review status for linus..mm-stable 2026-08-27 09:17:06 -07:00
tve200 drm/tve200: add OF module alias for autoloading 2026-07-24 09:21:03 +02:00
tyr drm for 7.3-rc1 2026-08-21 08:41:00 -07:00
udl drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
v3d Linux 7.2 2026-08-20 10:58:44 +10:00
vboxvideo drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
vc4 Linux 7.2 2026-08-20 10:58:44 +10:00
verisilicon drm/verisilicon: Switch to atomic_create_state 2026-06-22 11:24:55 +02:00
vgem
virtio Merge drm/drm-fixes into drm-misc-fixes 2026-09-01 09:38:51 +02:00
vkms drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
vmwgfx mm.git review status for mm-hotfixes-stable..mm-stable 2026-08-20 18:17:08 -07:00
xe drm next/fixes for 7.3-rc1 2026-08-28 16:37:55 -07:00
xen mm: introduce vma_get_page_prot() and use it 2026-08-06 18:57:03 -07:00
xlnx drm/xlnx: zynqmp_dp: Switch to atomic_create_state 2026-06-22 11:24:56 +02:00
drm_atomic_helper.c drm/atomic-helper: Add HDMI bridge output bus formats helper 2026-06-09 21:03:50 +01:00
drm_atomic_state_helper.c drm/atomic-state-helper: set pixel_blend_mode to prop default on reset 2026-09-02 15:40:52 -03:00
drm_atomic_uapi.c Merge drm/drm-fixes into drm-misc-fixes 2026-09-01 09:38:51 +02:00
drm_atomic.c drm/bridge: rename drm_for_each_bridge_in_chain_scoped() to drm_for_each_bridge_in_chain() 2026-07-14 17:55:51 +02:00
drm_auth.c drm/auth: Only drm_drop_master if it exists 2026-04-21 22:05:51 +08:00
drm_blend.c drm/drm_blend: allow blend mode property without PREMULTI 2026-07-14 19:22:48 +01:00
drm_bridge_helper.c
drm_bridge.c drm/bridge: Remove legacy bridge callback support 2026-07-15 09:46:16 +02:00
drm_buddy.c gpu/buddy: Track per-order used blocks with a scoreboard 2026-05-29 13:44:01 +02:00
drm_cache.c x86/cpu: Hide and rename static_cpu_has() 2026-07-06 21:34:26 -07:00
drm_client_event.c
drm_client_modeset.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_client_sysrq.c
drm_client.c
drm_color_mgmt.c mm.git review status for mm-hotfixes-stable..mm-nonmm-stable 2026-06-21 13:20:19 -07:00
drm_colorop.c drm-misc-next for 7.3: 2026-07-06 17:38:49 +10:00
drm_connector.c drm-misc-next for 7.3: 2026-07-06 17:38:49 +10:00
drm_crtc_helper_internal.h
drm_crtc_helper.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_crtc_internal.h drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_crtc.c
drm_damage_helper.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_debugfs_crc.c
drm_debugfs.c
drm_displayid_internal.h Merge drm/drm-next into drm-misc-next 2026-06-30 10:16:00 +02:00
drm_displayid.c
drm_draw_internal.h drm/draw: Remove unused helper drm_draw_get_char_bitmap() 2026-06-04 09:44:11 +02:00
drm_draw.c
drm_drv.c DRM Rust changes for v7.3-rc1 2026-08-10 14:48:11 +10:00
drm_dumb_buffers.c drm-misc-next for 7.3: 2026-07-06 17:38:49 +10:00
drm_edid_load.c
drm_edid.c Merge drm/drm-next into drm-misc-next 2026-06-30 10:16:00 +02:00
drm_eld.c
drm_encoder.c drm/encoder: drm_encoder_cleanup: lock the encoder chain mutex during removal 2026-04-16 09:08:42 +02:00
drm_exec.c drm/exec: Use kvmalloc_objs for exec->objects 2026-07-07 23:16:33 +08:00
drm_fb_dma_helper.c
drm_fb_helper.c Linux 7.2 2026-08-20 10:58:44 +10:00
drm_fbdev_dma.c
drm_fbdev_shmem.c
drm_fbdev_ttm.c
drm_file.c
drm_flip_work.c
drm_format_helper.c
drm_format_internal.h
drm_fourcc.c drm/fourcc: Add DRM_FORMAT_XVUY2101010 2026-05-05 14:04:29 +03:00
drm_framebuffer.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_gem_atomic_helper.c
drm_gem_dma_helper.c mm: introduce vma_get_page_prot() and use it 2026-08-06 18:57:03 -07:00
drm_gem_framebuffer_helper.c drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() 2026-04-27 11:27:22 +02:00
drm_gem_shmem_helper.c mm.git review status for linus..mm-stable 2026-08-27 09:17:06 -07:00
drm_gem_ttm_helper.c
drm_gem_vram_helper.c drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs 2026-04-09 09:34:28 +02:00
drm_gem.c drm for 7.3-rc1 2026-08-21 08:41:00 -07:00
drm_gpusvm.c drm for 7.3-rc1 2026-08-21 08:41:00 -07:00
drm_gpuvm.c drm/gpuvm: Remove dead code 2026-07-03 23:32:55 +02:00
drm_internal.h
drm_ioc32.c
drm_ioctl.c drm: Guard DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE 2026-07-07 14:57:10 +02:00
drm_kms_helper_common.c
drm_lease.c
drm_managed.c drm/managed: use special gfp_t format specifier 2026-05-28 21:04:52 -07:00
drm_mipi_dbi.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_mipi_dsi.c drm/mipi-dsi: add mipi_dsi_shutdown_peripheral_multi 2026-04-24 10:12:16 -07:00
drm_mm.c
drm_mode_config.c drm: use drm_warn() in validate_blend_mode_for_alpha_formats() 2026-08-14 14:43:23 +01:00
drm_mode_object.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_modes.c drm/modes: Add DRM_MODE_MATCH_TIMINGS_VRR 2026-06-24 18:54:10 +03:00
drm_modeset_helper.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_modeset_lock.c drm: remove dead WARN_ON NULL check after GFP_NOFAIL allocation 2026-08-05 11:20:13 -07:00
drm_of.c drm/panel: of_drm_find_panel() return a counted reference 2026-07-20 15:07:22 +02:00
drm_pagemap_util.c
drm_pagemap.c drm/pagemap: Fix folio allocation fallback and use-after-put 2026-09-02 12:25:32 -07:00
drm_panel_backlight_quirks.c drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05 2026-07-17 17:41:15 -04:00
drm_panel_orientation_quirks.c
drm_panel.c drm/panel: find_panel_by_fwnode() return a counted reference 2026-07-20 15:08:08 +02:00
drm_panic_qr.rs
drm_panic.c drm/panic: Look up glyph shape with font helper 2026-06-04 09:44:10 +02:00
drm_pci.c
drm_plane_helper.c
drm_plane.c
drm_prime.c drm/prime: use dma_buf_fd_install() to preserve export tracing 2026-08-24 14:19:43 +02:00
drm_print.c drm/print: describe 6th & 9th bit of drm.debug 2026-06-03 11:24:52 +02:00
drm_privacy_screen_x86.c
drm_privacy_screen.c
drm_probe_helper.c drm: Send per-connector hotplug events 2026-07-21 17:06:42 +01:00
drm_property.c
drm_ras_genl_family.c
drm_ras_nl.c drm/drm_ras: Add clear-error-counter netlink command to drm_ras 2026-04-24 08:43:42 -04:00
drm_ras_nl.h drm/drm_ras: Add clear-error-counter netlink command to drm_ras 2026-04-24 08:43:42 -04:00
drm_ras.c drm/drm_ras: Add clear-error-counter netlink command to drm_ras 2026-04-24 08:43:42 -04:00
drm_rect.c
drm_self_refresh_helper.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_simple_kms_helper.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_suballoc.c
drm_syncobj.c drm/syncobj: Use kmalloc_objs for chains 2026-07-07 23:26:39 +08:00
drm_sysfs.c
drm_trace_points.c
drm_trace.h
drm_vblank_helper.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_vblank_work.c
drm_vblank.c
drm_vma_manager.c
drm_writeback.c drm: writeback: Document behaviour for framebuffer size mismatch 2026-06-15 22:28:26 +01:00
Kconfig drm/gpuvm: rust: add RUST_DRM_GPUVM option to Kconfig 2026-05-05 12:59:41 +02:00
Kconfig.debug
Makefile gpu: build nova-core and nova-drm from drivers/gpu/Makefile 2026-06-29 11:28:38 +02:00