From patchwork Tue Apr 11 03:31:42 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeffy Chen X-Patchwork-Id: 9676365 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A3C3F601C3 for ; Wed, 12 Apr 2017 01:10:15 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8ECE128565 for ; Wed, 12 Apr 2017 01:10:15 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 82CAC28573; Wed, 12 Apr 2017 01:10:15 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 2D6A428565 for ; Wed, 12 Apr 2017 01:10:15 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id D207A6E669; Wed, 12 Apr 2017 01:08:28 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from smtphy.263.net (syd-smtp01.263.net [54.79.106.188]) by gabe.freedesktop.org (Postfix) with ESMTPS id 8F44C6E3D4 for ; Tue, 11 Apr 2017 03:32:44 +0000 (UTC) Received: from smtphy.263.net (sg-smtp01.263.net [54.255.195.220]) by smtphy.263.net (Postfix) with ESMTPS id 7F03840205 for ; Tue, 11 Apr 2017 11:32:40 +0800 (CST) Received: from transport.263xmail.com (unknown [38.83.106.156]) by smtphy.263.net (Postfix) with ESMTPS id B628489 for ; Tue, 11 Apr 2017 11:32:36 +0800 (CST) Received: from regular2.263xmail.com (unknown [192.168.165.160]) by transport.263xmail.com (Postfix) with ESMTP id B28D66B1 for ; Tue, 11 Apr 2017 11:32:31 +0800 (CST) Received: from regular1.263xmail.com (unknown [192.168.165.232]) by regular2.263xmail.com (Postfix) with ESMTP id 4B91E1EF77 for ; Tue, 11 Apr 2017 11:32:29 +0800 (CST) Received: from jeffy.chen?rock-chips.com (unknown [192.168.165.103]) by regular1.263xmail.com (Postfix) with ESMTP id F17D095FD; Tue, 11 Apr 2017 11:32:07 +0800 (CST) X-263anti-spam: KSV:0; X-MAIL-GRAY: 0 X-MAIL-DELIVERY: 1 X-KSVirus-check: 0 X-ABS-CHECKED: 4 Received: from smtp.263.net (sg-smtp01.263.net [54.255.195.220]) by smtp.263.net (Postfix) with ESMTP id 6953A375; Tue, 11 Apr 2017 11:32:06 +0800 (CST) Received: from localhost (localhost.localdomain [127.0.0.1]) by smtp.263.net (Postfix) with ESMTP id 1BF7FDF30F; Tue, 11 Apr 2017 11:32:06 +0800 (CST) X-RL-SENDER: jeffy.chen@rock-chips.com X-FST-TO: linux-kernel@vger.kernel.org X-SENDER-IP: 103.29.142.67 X-LOGIN-NAME: jeffy.chen@rock-chips.com X-UNIQUE-TAG: <6eda789f6e85a8b2d747c49388c32a03> X-ATTACHMENT-NUM: 0 X-SENDER: cjf@rock-chips.com X-DNS-TYPE: 0 Received: from localhost (unknown [103.29.142.67]) by smtp.263.net (Postfix) whith ESMTP id 29142IVA2A9; Tue, 11 Apr 2017 11:32:07 +0800 (CST) From: Jeffy Chen To: linux-kernel@vger.kernel.org Subject: [PATCH v7 2/2] drm: Prevent release fb after cleanup drm_mode_config Date: Tue, 11 Apr 2017 11:31:42 +0800 Message-Id: <1491881502-24357-3-git-send-email-jeffy.chen@rock-chips.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1491881502-24357-1-git-send-email-jeffy.chen@rock-chips.com> References: <1491881502-24357-1-git-send-email-jeffy.chen@rock-chips.com> X-Mailman-Approved-At: Wed, 12 Apr 2017 01:08:13 +0000 Cc: Jeffy Chen , briannorris@chromium.org, dianders@chromium.org, tfiga@chromium.org, dri-devel@lists.freedesktop.org, Daniel Vetter , zyw@rock-chips.com, marcheu@chromium.org, hshi@chromium.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP We are freeing all framebuffers in drm_mode_config_cleanup without sync the drm_file's fbs list. So if someone try to unbind drm before release drm dev fd, the fbs list would remain some invalid fb references. And that would cause crash later in drm_fb_release. Add a sanity check to prevent that. Signed-off-by: Jeffy Chen --- Changes in v7: Update commit message. Changes in v6: None Changes in v5: None Changes in v2: None drivers/gpu/drm/drm_framebuffer.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c index e8f9c13..03c1632 100644 --- a/drivers/gpu/drm/drm_framebuffer.c +++ b/drivers/gpu/drm/drm_framebuffer.c @@ -583,6 +583,11 @@ void drm_fb_release(struct drm_file *priv) { struct drm_framebuffer *fb, *tfb; struct drm_mode_rmfb_work arg; + struct drm_minor *minor = priv->minor; + struct drm_device *dev = minor->dev; + + if (WARN_ON(!dev->mode_config.num_fb && !list_empty(&priv->fbs))) + return; INIT_LIST_HEAD(&arg.fbs);