⬢ DragonFlyBSD Kernel Audit
DF-4430 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/drm/radeon/radeon_ttm.c
+++ b/sys/dev/drm/radeon/radeon_ttm.c
@@ -734,12 +734,11 @@ static int radeon_ttm_tt_populate(struct ttm_tt *ttm,
 	struct radeon_ttm_tt *gtt = radeon_ttm_tt_to_gtt(ttm);
 	struct radeon_device *rdev;
 	unsigned i;
 	int r;
-#ifdef DUMBBELL_WIP
+
 	bool slave = !!(ttm->page_flags & TTM_PAGE_FLAG_SG);
-#endif /* DUMBBELL_WIP */
 
 #if 0
 	if (gtt && gtt->userptr) {
@@ -751,15 +750,13 @@ static int radeon_ttm_tt_populate(struct ttm_tt *ttm,
 	}
 #endif
 
-#ifdef DUMBBELL_WIP
 	/*
-	 * Maybe unneeded on FreeBSD.
-	 *   -- dumbbell@
+	 * PRIME-imported (SG) buffer object: the backing pages come from
+	 * the dma-buf's scatter-gather table, not from the page pool.
+	 * Mirrors amdgpu_ttm.c amdgpu_ttm_tt_populate().  Without this the
+	 * pool allocates fresh pages for an imported BO (GPU view diverges
+	 * from the exporter's memory) and unpopulate()'s slave early-return
+	 * then leaks those pages and their ttm_mem_global accounting.
 	 */
 	if (slave && ttm->sg) {
 		drm_prime_sg_to_page_addr_arrays(ttm->sg, ttm->pages,
 						 gtt->ttm.dma_address, ttm->num_pages);
 		ttm->state = tt_unbound;
 		return 0;
 	}
-#endif /* DUMBBELL_WIP */
 
 	rdev = radeon_get_rdev(ttm->bdev);