[PATCH] drm/i915: Fix page cleanup on DMA remap failure

[Vidya Srinivas]

From: Brian Geffon <bgeffon at google.com>

(Submitting patch from Google for check on trybot)

Reason:

Crash observed:
<4>[1531008.404813] i915 0000:00:02.0: Failed to DMA remap 147457 pages
<1>[1531008.416026] BUG: Bad page state in process chrome  pfn:14200
<4>[1531008.416031] page:000000008ca3ab65 refcount:0 mapcount:1 mapping:00000000b6bc9227 index:0x0 pfn:0x14200
<4>[1531008.416034] head:000000008ca3ab65 order:0 entire_mapcount:1 nr_pages_mapped:0 pincount:0

Mostly seen Under memory pressure on low memory devices.

When converting to folios the cleanup path of shmem_get_pages() was
missed. When a DMA remap fails and the max segment size is greater than
PAGE_SIZE it will attempt to retry the remap with a PAGE_SIZEd segment
size. The cleanup code isn't properly using the folio apis and as a
result isn't handling compound pages correctly.

Fixes: 0b62af28f249 ("i915: convert shmem_sg_free_table() to use a folio_batch")
Signed-off-by: Brian Geffon <bgeffon at google.com>
Suggested-by: Tomasz Figa <tfiga at google.com>
---
 drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
index fe69f2c8527d..0da5c8894cea 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
@@ -37,8 +37,6 @@ void shmem_sg_free_table(struct sg_table *st, struct address_space *mapping,
 	struct folio *last = NULL;
 	struct page *page;
 
-	mapping_clear_unevictable(mapping);
-
 	folio_batch_init(&fbatch);
 	for_each_sgt_page(page, sgt_iter, st) {
 		struct folio *folio = page_folio(page);
@@ -180,12 +178,11 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st,
 	return 0;
 err_sg:
 	sg_mark_end(sg);
+	mapping_clear_unevictable(mapping);
 	if (sg != st->sgl) {
 		shmem_sg_free_table(st, mapping, false, false);
-	} else {
-		mapping_clear_unevictable(mapping);
+	} else
 		sg_free_table(st);
-	}
 
 	/*
 	 * shmemfs first checks if there is enough memory to allocate the page
@@ -209,8 +206,6 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj)
 	struct address_space *mapping = obj->base.filp->f_mapping;
 	unsigned int max_segment = i915_sg_segment_size(i915->drm.dev);
 	struct sg_table *st;
-	struct sgt_iter sgt_iter;
-	struct page *page;
 	int ret;
 
 	/*
@@ -239,9 +234,7 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj)
 		 * for PAGE_SIZE chunks instead may be helpful.
 		 */
 		if (max_segment > PAGE_SIZE) {
-			for_each_sgt_page(page, sgt_iter, st)
-				put_page(page);
-			sg_free_table(st);
+                       shmem_sg_free_table(st, mapping, false, false);
 			kfree(st);
 
 			max_segment = PAGE_SIZE;
@@ -265,6 +258,7 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj)
 	return 0;
 
 err_pages:
+	mapping_clear_unevictable(mapping);
 	shmem_sg_free_table(st, mapping, false, false);
 	/*
 	 * shmemfs first checks if there is enough memory to allocate the page
@@ -402,6 +396,7 @@ void i915_gem_object_put_pages_shmem(struct drm_i915_gem_object *obj, struct sg_
 	if (i915_gem_object_needs_bit17_swizzle(obj))
 		i915_gem_object_save_bit_17_swizzle(obj, pages);
 
+        mapping_clear_unevictable(file_inode(obj->base.filp)->i_mapping);
 	shmem_sg_free_table(pages, file_inode(obj->base.filp)->i_mapping,
 			    obj->mm.dirty, obj->mm.madv == I915_MADV_WILLNEED);
 	kfree(pages);
-- 
2.34.1