From patchwork Fri Oct 11 15:47:30 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jun Chen X-Patchwork-Id: 3022111 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id C39EC9F245 for ; Fri, 11 Oct 2013 10:27:59 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 2B779202A1 for ; Fri, 11 Oct 2013 10:27:55 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id EBD4220328 for ; Fri, 11 Oct 2013 10:27:53 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 0164EE7EFD for ; Fri, 11 Oct 2013 03:27:54 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by gabe.freedesktop.org (Postfix) with ESMTP id E1863E5E10 for ; Fri, 11 Oct 2013 00:48:43 -0700 (PDT) Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga102.jf.intel.com with ESMTP; 11 Oct 2013 00:45:28 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos; i="4.90,1078,1371106800"; d="scan'208"; a="391465108" Received: from chenjun-workstation.sh.intel.com (HELO [10.239.67.223]) ([10.239.67.223]) by orsmga001.jf.intel.com with ESMTP; 11 Oct 2013 00:48:41 -0700 Subject: [PATCH] drm: Add the mutex protection in drm_do_vm_fault. From: Jun Chen To: airlied@linux.ie, viro@zeniv.linux.org.uk, airlied@redhat.com Date: Fri, 11 Oct 2013 11:47:30 -0400 Message-ID: <1381506450.7844.4.camel@chenjun-workstation> Mime-Version: 1.0 X-Mailer: Evolution 2.32.2 X-Mailman-Approved-At: Fri, 11 Oct 2013 03:25:32 -0700 Cc: Jun Chen , Linux Kernel , dri-devel@lists.freedesktop.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org Errors-To: dri-devel-bounces+patchwork-dri-devel=patchwork.kernel.org@lists.freedesktop.org X-Spam-Status: No, score=-1.4 required=5.0 tests=BAYES_00, DATE_IN_FUTURE_03_06, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP There are no mutex protection for the dev->map_hash while calling the drm_ht_find_item in the function drm_do_vm_fault. So try to mutex firstly and then find the list for using to avoid this race condition. Signed-off-by: Chen Jun --- drivers/gpu/drm/drm_vm.c | 11 +++++++++-- 1 files changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_vm.c b/drivers/gpu/drm/drm_vm.c index b5c5af7..1d95221 100644 --- a/drivers/gpu/drm/drm_vm.c +++ b/drivers/gpu/drm/drm_vm.c @@ -107,8 +107,11 @@ static int drm_do_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) if (!dev->agp || !dev->agp->cant_use_aperture) goto vm_fault_error; - if (drm_ht_find_item(&dev->map_hash, vma->vm_pgoff, &hash)) + mutex_lock(&dev->struct_mutex); + if (drm_ht_find_item(&dev->map_hash, vma->vm_pgoff, &hash)) { + mutex_unlock(&dev->struct_mutex); goto vm_fault_error; + } r_list = drm_hash_entry(hash, struct drm_map_list, hash); map = r_list->map; @@ -140,8 +143,10 @@ static int drm_do_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) break; } - if (&agpmem->head == &dev->agp->memory) + if (&agpmem->head == &dev->agp->memory) { + mutex_unlock(&dev->struct_mutex); goto vm_fault_error; + } /* * Get the page, inc the use count, and return it @@ -151,6 +156,7 @@ static int drm_do_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) get_page(page); vmf->page = page; + mutex_unlock(&dev->struct_mutex); DRM_DEBUG ("baddr = 0x%llx page = 0x%p, offset = 0x%llx, count=%d\n", (unsigned long long)baddr, @@ -159,6 +165,7 @@ static int drm_do_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) page_count(page)); return 0; } + mutex_unlock(&dev->struct_mutex); vm_fault_error: return VM_FAULT_SIGBUS; /* Disallow mremap */ }