[PATCH] drm: Remove "protection" around drm_vma_offset_manager_destroy()

[PATCH] drm: Remove "protection" around drm_vma_offset_manager_destroy()

[Chris Wilson]

Using a spinlock to serialize the destroy function, within the destroy
function itself does not prevent the buggy driver from shooting
themselves in the foot - either way they still have a use-after-free
issue.

Reported-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Liviu Dudau <Liviu.Dudau@arm.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
---
 drivers/gpu/drm/drm_vma_manager.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/gpu/drm/drm_vma_manager.c b/drivers/gpu/drm/drm_vma_manager.c
index a6b2fe36b025..c5d0d2358301 100644
--- a/drivers/gpu/drm/drm_vma_manager.c
+++ b/drivers/gpu/drm/drm_vma_manager.c
@@ -103,10 +103,7 @@ EXPORT_SYMBOL(drm_vma_offset_manager_init);
  */
 void drm_vma_offset_manager_destroy(struct drm_vma_offset_manager *mgr)
 {
-	/* take the lock to protect against buggy drivers */
-	write_lock(&mgr->vm_lock);
 	drm_mm_takedown(&mgr->vm_addr_space_mm);
-	write_unlock(&mgr->vm_lock);
 }
 EXPORT_SYMBOL(drm_vma_offset_manager_destroy);
 
-- 
2.19.0.rc1

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

✓ Fi.CI.BAT: success for drm: Remove "protection" around drm_vma_offset_manager_destroy()

[Patchwork]

== Series Details ==

Series: drm: Remove "protection" around drm_vma_offset_manager_destroy()
URL   : https://patchwork.freedesktop.org/series/49069/
State : success

== Summary ==

= CI Bug Log - changes from CI_DRM_4754 -> Patchwork_10069 =

== Summary - SUCCESS ==

  No regressions found.

  External URL: https://patchwork.freedesktop.org/api/1.0/series/49069/revisions/1/mbox/

== Known issues ==

  Here are the changes found in Patchwork_10069 that come from known issues:

  === IGT changes ===

    ==== Issues hit ====

    igt@gem_exec_suspend@basic-s3:
      fi-blb-e6850:       PASS -> INCOMPLETE (fdo#107718)

    igt@kms_pipe_crc_basic@suspend-read-crc-pipe-a:
      {fi-byt-clapper}:   PASS -> FAIL (fdo#103191, fdo#107362)

    
    ==== Possible fixes ====

    igt@kms_pipe_crc_basic@read-crc-pipe-b-frame-sequence:
      {fi-byt-clapper}:   FAIL (fdo#103191, fdo#107362) -> PASS

    igt@kms_pipe_crc_basic@suspend-read-crc-pipe-b:
      fi-snb-2520m:       INCOMPLETE (fdo#103713) -> PASS

    
  {name}: This element is suppressed. This means it is ignored when computing
          the status of the difference (SUCCESS, WARNING, or FAILURE).

  fdo#103191 https://bugs.freedesktop.org/show_bug.cgi?id=103191
  fdo#103713 https://bugs.freedesktop.org/show_bug.cgi?id=103713
  fdo#107362 https://bugs.freedesktop.org/show_bug.cgi?id=107362
  fdo#107718 https://bugs.freedesktop.org/show_bug.cgi?id=107718


== Participating hosts (52 -> 47) ==

  Additional (1): fi-skl-6700hq 
  Missing    (6): fi-hsw-4770r fi-ilk-m540 fi-hsw-4200u fi-byt-squawks fi-bsw-cyan fi-ctg-p8600 


== Build changes ==

    * Linux: CI_DRM_4754 -> Patchwork_10069

  CI_DRM_4754: b6b0b80157c9ecad0569a42bb8efeb6d2f27dfb3 @ git://anongit.freedesktop.org/gfx-ci/linux
  IGT_4620: 20087bf22698612a526353f022bc232e2b0dcdcc @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools
  Patchwork_10069: 72665cf7563f4485efa6b4a9606b7162f442c69e @ git://anongit.freedesktop.org/gfx-ci/linux


== Linux commits ==

72665cf7563f drm: Remove "protection" around drm_vma_offset_manager_destroy()

== Logs ==

For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_10069/issues.html
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

✓ Fi.CI.IGT: success for drm: Remove "protection" around drm_vma_offset_manager_destroy()

[Patchwork]

== Series Details ==

Series: drm: Remove "protection" around drm_vma_offset_manager_destroy()
URL   : https://patchwork.freedesktop.org/series/49069/
State : success

== Summary ==

= CI Bug Log - changes from CI_DRM_4754_full -> Patchwork_10069_full =

== Summary - SUCCESS ==

  No regressions found.

  

== Known issues ==

  Here are the changes found in Patchwork_10069_full that come from known issues:

  === IGT changes ===

    ==== Issues hit ====

    igt@kms_setmode@basic:
      shard-apl:          PASS -> FAIL (fdo#99912)

    
    ==== Possible fixes ====

    igt@kms_cursor_legacy@cursor-vs-flip-toggle:
      shard-hsw:          FAIL (fdo#103355) -> PASS

    igt@perf@blocking:
      shard-hsw:          FAIL (fdo#102252) -> PASS

    
  fdo#102252 https://bugs.freedesktop.org/show_bug.cgi?id=102252
  fdo#103355 https://bugs.freedesktop.org/show_bug.cgi?id=103355
  fdo#99912 https://bugs.freedesktop.org/show_bug.cgi?id=99912


== Participating hosts (5 -> 5) ==

  No changes in participating hosts


== Build changes ==

    * Linux: CI_DRM_4754 -> Patchwork_10069

  CI_DRM_4754: b6b0b80157c9ecad0569a42bb8efeb6d2f27dfb3 @ git://anongit.freedesktop.org/gfx-ci/linux
  IGT_4620: 20087bf22698612a526353f022bc232e2b0dcdcc @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools
  Patchwork_10069: 72665cf7563f4485efa6b4a9606b7162f442c69e @ git://anongit.freedesktop.org/gfx-ci/linux
  piglit_4509: fdc5a4ca11124ab8413c7988896eec4c97336694 @ git://anongit.freedesktop.org/piglit

== Logs ==

For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_10069/shards.html
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH] drm: Remove "protection" around drm_vma_offset_manager_destroy()

[Daniel Vetter]

On Mon, Sep 03, 2018 at 10:31:55AM +0100, Chris Wilson wrote:
> Using a spinlock to serialize the destroy function, within the destroy
> function itself does not prevent the buggy driver from shooting
> themselves in the foot - either way they still have a use-after-free
> issue.
> 
> Reported-by: Jia-Ju Bai <baijiaju1990@gmail.com>
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Davidlohr Bueso <dave@stgolabs.net>
> Cc: Liviu Dudau <Liviu.Dudau@arm.com>
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>

Ah, now I understand a bit more ...

Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> ---
>  drivers/gpu/drm/drm_vma_manager.c | 3 ---
>  1 file changed, 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_vma_manager.c b/drivers/gpu/drm/drm_vma_manager.c
> index a6b2fe36b025..c5d0d2358301 100644
> --- a/drivers/gpu/drm/drm_vma_manager.c
> +++ b/drivers/gpu/drm/drm_vma_manager.c
> @@ -103,10 +103,7 @@ EXPORT_SYMBOL(drm_vma_offset_manager_init);
>   */
>  void drm_vma_offset_manager_destroy(struct drm_vma_offset_manager *mgr)
>  {
> -	/* take the lock to protect against buggy drivers */
> -	write_lock(&mgr->vm_lock);
>  	drm_mm_takedown(&mgr->vm_addr_space_mm);
> -	write_unlock(&mgr->vm_lock);
>  }
>  EXPORT_SYMBOL(drm_vma_offset_manager_destroy);
>  
> -- 
> 2.19.0.rc1
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx