diff options
authorNicholas Kazlauskas <>2018-12-14 12:26:58 -0500
committerAlex Deucher <>2018-12-18 17:39:26 -0500
commit77acd1cd912987ffd62dad6a09275a1fb406f0c2 (patch)
parent379c237e392e4cec09ff5853b5c0724a1e5d51b0 (diff)
drm/amd/display: Skip fast cursor updates for fb changes
[Why] The behavior of drm_atomic_helper_cleanup_planes differs depending on whether the commit was asynchronous or not. When it's called from amdgpu_dm_atomic_commit_tail during a typical atomic commit the plane state has been swapped so it calls cleanup_fb on the old plane state. However, in the asynchronous commit codepath the call to drm_atomic_helper_commit also calls dm_plane_helper_cleanup_fb after atomic_async_update has been called. Since the plane state is updated in place and has not been swapped the cleanup_fb call affects the new plane state. This results in a use after free for the given sequence: - Fast update, fb1 pin/ref, fb1 unpin/unref - Fast update, fb2 pin/ref, fb2 unpin/unref - Slow update, fb1 pin/ref, fb2 unpin/unref - Fast update, fb2 pin/ref -> use after free. bug [How] Disallow framebuffer changes in the fast path. Since this includes a NULL framebuffer, this means that only framebuffers that have been previously pin+ref at least once will be used, preventing a use after free. This has a significant throughput reduction for cursor updates where the framebuffer changes. For most desktop usage this isn't a problem, but it does introduce performance regressions for two specific IGT tests: - cursor-vs-flip-toggle - cursor-vs-flip-varying-size Fixes: 2cc751931afc ("drm/amd/display: Add fast path for cursor plane updates") Signed-off-by: Nicholas Kazlauskas <> Reviewed-by: Andrey Grodzovsky <> Reviewed-by: Harry Wentland <> Signed-off-by: Alex Deucher <>
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index c13856a46d8e..753c6c260073 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -3628,10 +3628,20 @@ static int dm_plane_atomic_check(struct drm_plane *plane,
static int dm_plane_atomic_async_check(struct drm_plane *plane,
struct drm_plane_state *new_plane_state)
+ struct drm_plane_state *old_plane_state =
+ drm_atomic_get_old_plane_state(new_plane_state->state, plane);
/* Only support async updates on cursor planes. */
if (plane->type != DRM_PLANE_TYPE_CURSOR)
return -EINVAL;
+ /*
+ * DRM calls prepare_fb and cleanup_fb on new_plane_state for
+ * async commits so don't allow fb changes.
+ */
+ if (old_plane_state->fb != new_plane_state->fb)
+ return -EINVAL;
return 0;