From patchwork Fri Sep 28 23:21:23 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Anholt X-Patchwork-Id: 10620555 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 89C596CB for ; Fri, 28 Sep 2018 23:21:37 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7A1552BAEE for ; Fri, 28 Sep 2018 23:21:37 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6E27F2BB12; Fri, 28 Sep 2018 23:21:37 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 10FFA2BAEE for ; Fri, 28 Sep 2018 23:21:37 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 44A326E0FE; Fri, 28 Sep 2018 23:21:32 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from anholt.net (anholt.net [50.246.234.109]) by gabe.freedesktop.org (Postfix) with ESMTP id EF9C56E04D for ; Fri, 28 Sep 2018 23:21:30 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by anholt.net (Postfix) with ESMTP id 1427D10A1AF1; Fri, 28 Sep 2018 16:21:30 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at anholt.net Received: from anholt.net ([127.0.0.1]) by localhost (kingsolver.anholt.net [127.0.0.1]) (amavisd-new, port 10024) with LMTP id DkX1X_iNQ64i; Fri, 28 Sep 2018 16:21:28 -0700 (PDT) Received: from eliezer.anholt.net (localhost [127.0.0.1]) by anholt.net (Postfix) with ESMTP id 0253310A1504; Fri, 28 Sep 2018 16:21:27 -0700 (PDT) Received: by eliezer.anholt.net (Postfix, from userid 1000) id DDF462FE1B40; Fri, 28 Sep 2018 16:21:26 -0700 (PDT) From: Eric Anholt To: dri-devel@lists.freedesktop.org Subject: [PATCH 1/4] drm/v3d: Fix a use-after-free race accessing the scheduler's fences. Date: Fri, 28 Sep 2018 16:21:23 -0700 Message-Id: <20180928232126.4332-1-eric@anholt.net> X-Mailer: git-send-email 2.18.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: boris.brezillon@bootlin.com, linux-kernel@vger.kernel.org MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP Once we push the job, the scheduler could run it and free it. So, if we want to reference their fences, we need to grab them before then. I haven't seen this happen in many days of conformance test runtime, but let's still close the race. Signed-off-by: Eric Anholt Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+") Reviewed-by: Boris Brezillon --- drivers/gpu/drm/v3d/v3d_drv.h | 5 +++++ drivers/gpu/drm/v3d/v3d_gem.c | 8 ++++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h index 5042573e97f4..83c55ab6e1c0 100644 --- a/drivers/gpu/drm/v3d/v3d_drv.h +++ b/drivers/gpu/drm/v3d/v3d_drv.h @@ -204,6 +204,11 @@ struct v3d_exec_info { */ struct dma_fence *bin_done_fence; + /* Fence for when the scheduler considers the render to be + * done, for when the BOs reservations should be complete. + */ + struct dma_fence *render_done_fence; + struct kref refcount; /* This is the array of BOs that were looked up at the start of exec. */ diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c index e1fcbb4cd0ae..c98fbfbdb68e 100644 --- a/drivers/gpu/drm/v3d/v3d_gem.c +++ b/drivers/gpu/drm/v3d/v3d_gem.c @@ -209,7 +209,7 @@ v3d_flush_caches(struct v3d_dev *v3d) static void v3d_attach_object_fences(struct v3d_exec_info *exec) { - struct dma_fence *out_fence = &exec->render.base.s_fence->finished; + struct dma_fence *out_fence = exec->render_done_fence; struct v3d_bo *bo; int i; @@ -409,6 +409,7 @@ v3d_exec_cleanup(struct kref *ref) dma_fence_put(exec->render.done_fence); dma_fence_put(exec->bin_done_fence); + dma_fence_put(exec->render_done_fence); for (i = 0; i < exec->bo_count; i++) drm_gem_object_put_unlocked(&exec->bo[i]->base); @@ -574,6 +575,9 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data, if (ret) goto fail_unreserve; + exec->render_done_fence = + dma_fence_get(&exec->render.base.s_fence->finished); + kref_get(&exec->refcount); /* put by scheduler job completion */ drm_sched_entity_push_job(&exec->render.base, &v3d_priv->sched_entity[V3D_RENDER]); @@ -587,7 +591,7 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data, sync_out = drm_syncobj_find(file_priv, args->out_sync); if (sync_out) { drm_syncobj_replace_fence(sync_out, - &exec->render.base.s_fence->finished); + exec->render_done_fence); drm_syncobj_put(sync_out); }