From patchwork Fri Jan 8 23:27:05 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Chris Wilson X-Patchwork-Id: 7991241 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id EB9489F38D for ; Fri, 8 Jan 2016 23:27:23 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 10765201DD for ; Fri, 8 Jan 2016 23:27:23 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 32772201C7 for ; Fri, 8 Jan 2016 23:27:22 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 6D14F6E81C; Fri, 8 Jan 2016 15:27:20 -0800 (PST) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-wm0-f65.google.com (mail-wm0-f65.google.com [74.125.82.65]) by gabe.freedesktop.org (Postfix) with ESMTPS id 917E06E81C for ; Fri, 8 Jan 2016 15:27:15 -0800 (PST) Received: by mail-wm0-f65.google.com with SMTP id f206so17915348wmf.2 for ; Fri, 08 Jan 2016 15:27:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-type:content-transfer-encoding; bh=6pBtjOoEioODCGWgwawLj9Q33z7l6YdcsAJn+i865Fc=; b=eL3q5CpiIP3JNNR20p9r2zICbJygOkdFJWhKwKOgWKS/QSHJ0YRUkgk8YwWql5nK7F ydn/bok8zz4Fj4xAPByZ5+xnf3fc/teDTiHGTQPvgBNYEdVYjmVcBd7UwmcFPHTanbGG Ret/gHYKAR5B85wRftYZWVOHs8JFeNgEGlNJW41kmmiysat40hxqYvFIRSuMSA5wAdpZ y0VrgQIw30QtMs58veyn9YBzJv0IYwvUwdeR4OtnJsZsY2E13YOVA8Tu70lnhSBRg50X 97xe4TYpLeoUxNesfZ00qDsn4RfCb/y41UUqVq12F0nRFQn+v6W+9LUr4xnD0naNQsEE xGSg== X-Received: by 10.194.86.166 with SMTP id q6mr101148131wjz.69.1452295634228; Fri, 08 Jan 2016 15:27:14 -0800 (PST) Received: from haswell.alporthouse.com ([78.156.65.138]) by smtp.gmail.com with ESMTPSA id l7sm108192908wjx.14.2016.01.08.15.27.12 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 08 Jan 2016 15:27:12 -0800 (PST) From: Chris Wilson To: dri-devel@lists.freedesktop.org Subject: [PATCH v2] drm: Release driver references to handle before making it available again Date: Fri, 8 Jan 2016 23:27:05 +0000 Message-Id: <1452295625-17520-1-git-send-email-chris@chris-wilson.co.uk> X-Mailer: git-send-email 2.7.0.rc3 In-Reply-To: <1452284707-16639-1-git-send-email-chris@chris-wilson.co.uk> References: <1452284707-16639-1-git-send-email-chris@chris-wilson.co.uk> MIME-Version: 1.0 Cc: Daniel Vetter , Thierry Reding X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Spam-Status: No, score=-4.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,RP_MATCHES_RCVD,T_DKIM_INVALID,UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When userspace closes a handle, we remove it from the file->object_idr and then tell the driver to drop its references to that file/handle. However, as the file/handle is already available again for reuse, it may be reallocated back to userspace and active on a new object before the driver has had a chance to drop the old file/handle references. Whilst calling back into the driver, we have to drop the file->table_lock spinlock and so to prevent reusing the closed handle we mark that handle as stale in the idr, perform the callback and then remove the handle. We set the stale handle to point to the NULL object, then any idr_find() whilst the driver is removing the handle will return NULL, just as if the handle is already removed from idr. v2: Use NULL rather than an ERR_PTR to avoid having to adjust callers. idr_alloc() tracks existing handles using an internal bitmap, so we are free to use the NULL object as our stale identifier. Signed-off-by: Chris Wilson Cc: dri-devel@lists.freedesktop.org Cc: David Airlie Cc: Daniel Vetter Cc: Rob Clark Cc: Ville Syrjälä Cc: Thierry Reding Reviewed-by: Ville Syrjälä --- drivers/gpu/drm/drm_gem.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 2e8c77e71e1f..d1909d1a1eb4 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -294,18 +294,21 @@ drm_gem_handle_delete(struct drm_file *filp, u32 handle) spin_lock(&filp->table_lock); /* Check if we currently have a reference on the object */ - obj = idr_find(&filp->object_idr, handle); - if (obj == NULL) { + obj = idr_replace(&filp->object_idr, NULL, handle); + if (IS_ERR(obj)) { spin_unlock(&filp->table_lock); return -EINVAL; } dev = obj->dev; + spin_unlock(&filp->table_lock); /* Release reference and decrement refcount. */ + drm_gem_object_release_handle(handle, obj, filp); + + spin_lock(&filp->table_lock); idr_remove(&filp->object_idr, handle); spin_unlock(&filp->table_lock); - drm_gem_object_release_handle(handle, obj, filp); return 0; } EXPORT_SYMBOL(drm_gem_handle_delete);