| Message ID | 1491818445-11409-3-git-send-email-jeffy.chen@rock-chips.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Hi Sean, On 04/11/2017 04:31 AM, Sean Paul wrote: > On Mon, Apr 10, 2017 at 06:00:45PM +0800, Jeffy Chen wrote: >> After unbinding drm, the user space may still owns the drm dev fd, >> and may trigger fb release after cleanup mode config. >> >> Add a sanity check to prevent that. >> >> Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com> >> --- >> >> Changes in v6: None >> Changes in v5: None >> Changes in v2: None >> >> drivers/gpu/drm/drm_framebuffer.c | 5 +++++ >> 1 file changed, 5 insertions(+) >> >> diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c >> index e8f9c13..03c1632 100644 >> --- a/drivers/gpu/drm/drm_framebuffer.c >> +++ b/drivers/gpu/drm/drm_framebuffer.c >> @@ -583,6 +583,11 @@ void drm_fb_release(struct drm_file *priv) >> { >> struct drm_framebuffer *fb, *tfb; >> struct drm_mode_rmfb_work arg; >> + struct drm_minor *minor = priv->minor; >> + struct drm_device *dev = minor->dev; >> + >> + if (WARN_ON(!dev->mode_config.num_fb && !list_empty(&priv->fbs))) > > Have you actually seen this happen? num_fb should be tightly couple to > priv->fbs, so it seems like this could only result from a driver bug (or I'm not > reading the code correctly). yes, 100% repro by: 1/ start display server 2/ unbind drm 3/ stop display server the num_fb would be decreased(with a warning in drm_mode_config_cleanup's fb_list check) in drm_mode_config_cleanup->drm_framebuffer_free->rockchip_drm_fb_destroy->drm_framebuffer_cleanup this flow would not modify the priv->fbs at the same time. so it would still remains the pointer of those freed fb. > > Sean > >> + return; >> >> INIT_LIST_HEAD(&arg.fbs); >> >> -- >> 2.1.4 >> >
diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c index e8f9c13..03c1632 100644 --- a/drivers/gpu/drm/drm_framebuffer.c +++ b/drivers/gpu/drm/drm_framebuffer.c @@ -583,6 +583,11 @@ void drm_fb_release(struct drm_file *priv) { struct drm_framebuffer *fb, *tfb; struct drm_mode_rmfb_work arg; + struct drm_minor *minor = priv->minor; + struct drm_device *dev = minor->dev; + + if (WARN_ON(!dev->mode_config.num_fb && !list_empty(&priv->fbs))) + return; INIT_LIST_HEAD(&arg.fbs);
After unbinding drm, the user space may still owns the drm dev fd, and may trigger fb release after cleanup mode config. Add a sanity check to prevent that. Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com> --- Changes in v6: None Changes in v5: None Changes in v2: None drivers/gpu/drm/drm_framebuffer.c | 5 +++++ 1 file changed, 5 insertions(+)