drm/syncobj: Avoid kmalloc(GFP_KERNEL) under spinlock

Commit Message

Chunming Zhou Oct. 25, 2018, 3:08 p.m. UTC

drivers/gpu/drm/drm_syncobj.c:202:4-14: ERROR: function drm_syncobj_find_signal_pt_for_point called on line 390 inside lock on line 389 but uses GFP_KERNEL

  Find functions that refer to GFP_KERNEL but are called with locks held.

Generated by: scripts/coccinelle/locks/call_kern.cocci

v2:
syncobj->timeline still needs protect.

v3:
use a global signaled fence instead of re-allocation.

v4:
Don't need moving lock.
Don't expose func.

Tested by: syncobj_wait and ./deqp-vk -n dEQP-VK.*semaphore* with
lock debug kernel options enabled.

Signed-off-by: Chunming Zhou <[e-mail]>
Cc: Maarten Lankhorst <[e-mail]>
Cc: [e-mail]
Cc: Christian König <[e-mail]>
Cc: Chris Wilson <[e-mail]>
CC: Julia Lawall <[e-mail]>
---
 drivers/gpu/drm/drm_syncobj.c | 41 ++++++++++++++++++++---------------
 1 file changed, 24 insertions(+), 17 deletions(-)

Comments

Chris Wilson Oct. 25, 2018, 4:31 p.m. UTC | #1

Quoting Chunming Zhou (2018-10-25 16:08:31)
> drivers/gpu/drm/drm_syncobj.c:202:4-14: ERROR: function drm_syncobj_find_signal_pt_for_point called on line 390 inside lock on line 389 but uses GFP_KERNEL
> 
>   Find functions that refer to GFP_KERNEL but are called with locks held.
> 
> Generated by: scripts/coccinelle/locks/call_kern.cocci
> 
> v2:
> syncobj->timeline still needs protect.
> 
> v3:
> use a global signaled fence instead of re-allocation.
> 
> v4:
> Don't need moving lock.
> Don't expose func.
> 
> Tested by: syncobj_wait and ./deqp-vk -n dEQP-VK.*semaphore* with
> lock debug kernel options enabled.
> 
> Signed-off-by: Chunming Zhou <[e-mail]>
> Cc: Maarten Lankhorst <[e-mail]>
> Cc: [e-mail]
> Cc: Christian König <[e-mail]>
> Cc: Chris Wilson <[e-mail]>
> CC: Julia Lawall <[e-mail]>
> ---
> -       return NULL;
> +out:
> +       return f;

As it reduced to just a return, I'd probably have gone with multiple
returns in this instance. Still the compiler should have done the
equivalent and jumped to a single ret.

Reviewed-by: Chris Wilson <[e-mail]>
-Chris

Patch

diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index b7eaa603f368..fab0a2cf672e 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -80,6 +80,23 @@  struct drm_syncobj_signal_pt {
 	struct list_head list;
 };
 
+static DEFINE_SPINLOCK(signaled_fence_lock);
+static struct dma_fence signaled_fence;
+
+static struct dma_fence *drm_syncobj_signaled_fence_get(void)
+{
+	spin_lock(&signaled_fence_lock);
+	if (!signaled_fence.ops) {
+		dma_fence_init(&signaled_fence,
+			       &drm_syncobj_stub_fence_ops,
+			       &signaled_fence_lock,
+			       0, 0);
+		dma_fence_signal_locked(&signaled_fence);
+	}
+	spin_unlock(&signaled_fence_lock);
+
+	return dma_fence_get(&signaled_fence);
+}
 /**
  * drm_syncobj_find - lookup and reference a sync object.
  * @file_private: drm file private pointer
@@ -111,24 +128,12 @@  static struct dma_fence
 				      uint64_t point)
 {
 	struct drm_syncobj_signal_pt *signal_pt;
+	struct dma_fence *f = NULL;
 
 	if ((syncobj->type == DRM_SYNCOBJ_TYPE_TIMELINE) &&
 	    (point <= syncobj->timeline)) {
-		struct drm_syncobj_stub_fence *fence =
-			kzalloc(sizeof(struct drm_syncobj_stub_fence),
-				GFP_KERNEL);
-
-		if (!fence)
-			return NULL;
-		spin_lock_init(&fence->lock);
-		dma_fence_init(&fence->base,
-			       &drm_syncobj_stub_fence_ops,
-			       &fence->lock,
-			       syncobj->timeline_context,
-			       point);
-
-		dma_fence_signal(&fence->base);
-		return &fence->base;
+		f = drm_syncobj_signaled_fence_get();
+		goto out;
 	}
 
 	list_for_each_entry(signal_pt, &syncobj->signal_pt_list, list) {
@@ -137,9 +142,11 @@  static struct dma_fence
 		if ((syncobj->type == DRM_SYNCOBJ_TYPE_BINARY) &&
 		    (point != signal_pt->value))
 			continue;
-		return dma_fence_get(&signal_pt->fence_array->base);
+		f = dma_fence_get(&signal_pt->fence_array->base);
+		goto out;
 	}
-	return NULL;
+out:
+	return f;
 }
 
 static void drm_syncobj_add_callback_locked(struct drm_syncobj *syncobj,