From patchwork Fri Feb 27 12:03:37 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Vetter X-Patchwork-Id: 5900311 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 94FEE9F38E for ; Fri, 27 Feb 2015 12:02:09 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 934A4202E9 for ; Fri, 27 Feb 2015 12:02:08 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id A91B32028D for ; Fri, 27 Feb 2015 12:02:07 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id EA2396E18E; Fri, 27 Feb 2015 04:02:05 -0800 (PST) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-wg0-f50.google.com (mail-wg0-f50.google.com [74.125.82.50]) by gabe.freedesktop.org (Postfix) with ESMTP id A4BAD6E18E for ; Fri, 27 Feb 2015 04:02:04 -0800 (PST) Received: by wghl18 with SMTP id l18so19840011wgh.8 for ; Fri, 27 Feb 2015 04:02:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; h=from:to:cc:subject:date:message-id; bh=6r9q+Op2CayzX6Z2XrAPSsVwNFpTNzvlmhGTyLEIWDk=; b=F0ldZO+f2m6zzRh2u1l5cf853AiKzCGHoD1euOay9Lm9k971dhvklpoYn6s3U/xTG5 IlhNKlBRWtK3NEMUt+9ldxosZ5Y0V8GrdtUVFwqxOGDt0zEknkAmI5fKMfPsnndQDmQf wVdIvZtsO4gbTJen7Hcfn98Aikoa5Z+eXeBno= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=6r9q+Op2CayzX6Z2XrAPSsVwNFpTNzvlmhGTyLEIWDk=; b=NnJBtqMG+PwM40w9vDZNJKT7BoFU85W6XQbGMDAVcjAWIHNj7IwSgDtvQKTqYLuDvV K83CnxmWJiTeXVylx9GmoTfSpOVjO7XQAskUfoB8PdHWOWrtPmvPD+GMOOUEoKQdz5CR t27KvowZeQBIroCQlrM8wWRC3HCKTCiSYyqWC/agcNLS1/qKIxMQylzTHnDLbXrzP7S+ lN+9JHHkZxN3yqFlzQZZSEXJbuvoJ0NX4t9ZUHP8/wptroEPuAP4jhzBPug2irEejmRi Ve/llH9jQaVpo5m2TjAl6o4zIAutbFNnpFoFvM80bm+YoEF2PXCaZa06vo2wb5rcF//x 25MQ== X-Gm-Message-State: ALoCoQnUn/YeW2Q22k4SCOZfUcbx6yn09TeT3zyzxl8FIB+YhrwsoX4WaAI4pTvD5yz6hqCngk9B X-Received: by 10.180.91.47 with SMTP id cb15mr5713441wib.39.1425038522986; Fri, 27 Feb 2015 04:02:02 -0800 (PST) Received: from phenom.ffwll.local (212-51-149-109.fiber7.init7.net. [212.51.149.109]) by mx.google.com with ESMTPSA id j9sm5667137wjy.18.2015.02.27.04.02.00 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 27 Feb 2015 04:02:01 -0800 (PST) From: Daniel Vetter To: Intel Graphics Development , DRI Development Subject: [PATCH] drm: Fixup racy refcounting in plane_force_disable Date: Fri, 27 Feb 2015 13:03:37 +0100 Message-Id: <1425038617-8251-1-git-send-email-daniel.vetter@ffwll.ch> X-Mailer: git-send-email 2.1.4 Cc: Daniel Vetter , stable@vger.kernel.org, Daniel Vetter X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Spam-Status: No, score=-4.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED, T_DKIM_INVALID, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Originally it was impossible to be dropping the last refcount in this function since there was always one around still from the idr. But in commit 83f45fc360c8e16a330474860ebda872d1384c8c Author: Daniel Vetter Date: Wed Aug 6 09:10:18 2014 +0200 drm: Don't grab an fb reference for the idr we've switched to weak references, broke that assumption but forgot to fix it up. Since we still force-disable planes it's only possible to hit this when racing multiple rmfb with fbdev restoring or similar evil things. As long as userspace is nice it's impossible to hit the BUG_ON. But the BUG_ON would most likely be hit from fbdev code, which usually invovles the console_lock besides all modeset locks. So very likely we'd never get the bug reports if this was hit in the wild, hence better be safe than sorry and backport. Spotted by Matt Roper while reviewing other patches. Cc: stable@vger.kernel.org Cc: Matt Roper Signed-off-by: Daniel Vetter Reviewed-by: Matt Roper --- drivers/gpu/drm/drm_crtc.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index cc548ecd3634..897f51beaadd 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -524,17 +524,6 @@ void drm_framebuffer_reference(struct drm_framebuffer *fb) } EXPORT_SYMBOL(drm_framebuffer_reference); -static void drm_framebuffer_free_bug(struct kref *kref) -{ - BUG(); -} - -static void __drm_framebuffer_unreference(struct drm_framebuffer *fb) -{ - DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount)); - kref_put(&fb->refcount, drm_framebuffer_free_bug); -} - /** * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr * @fb: fb to unregister @@ -1319,7 +1308,7 @@ void drm_plane_force_disable(struct drm_plane *plane) return; } /* disconnect the plane from the fb and crtc: */ - __drm_framebuffer_unreference(plane->old_fb); + drm_framebuffer_unreference(plane->old_fb); plane->old_fb = NULL; plane->fb = NULL; plane->crtc = NULL;