* [PATCH] drm/radeon: fix rare segfault
@ 2012-07-02 16:40 j.glisse
2012-07-02 20:25 ` Alex Deucher
2012-07-03 9:29 ` Christian König
0 siblings, 2 replies; 3+ messages in thread
From: j.glisse @ 2012-07-02 16:40 UTC (permalink / raw)
To: dri-devel; +Cc: Jerome Glisse
From: Jerome Glisse <jglisse@redhat.com>
In gem idle/busy ioctl the radeon object was derefenced after
drm_gem_object_unreference_unlocked which in case the object
have been destroyed lead to use of a possibly free pointer with
possibly wrong data.
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
---
drivers/gpu/drm/radeon/radeon_gem.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index 74176c5..c8838fc 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -325,6 +325,7 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void *data,
int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
struct drm_file *filp)
{
+ struct radeon_device *rdev = dev->dev_private;
struct drm_radeon_gem_busy *args = data;
struct drm_gem_object *gobj;
struct radeon_bo *robj;
@@ -350,13 +351,14 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
break;
}
drm_gem_object_unreference_unlocked(gobj);
- r = radeon_gem_handle_lockup(robj->rdev, r);
+ r = radeon_gem_handle_lockup(rdev, r);
return r;
}
int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
struct drm_file *filp)
{
+ struct radeon_device *rdev = dev->dev_private;
struct drm_radeon_gem_wait_idle *args = data;
struct drm_gem_object *gobj;
struct radeon_bo *robj;
@@ -369,10 +371,10 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
robj = gem_to_radeon_bo(gobj);
r = radeon_bo_wait(robj, NULL, false);
/* callback hw specific functions if any */
- if (robj->rdev->asic->ioctl_wait_idle)
- robj->rdev->asic->ioctl_wait_idle(robj->rdev, robj);
+ if (rdev->asic->ioctl_wait_idle)
+ robj->rdev->asic->ioctl_wait_idle(rdev, robj);
drm_gem_object_unreference_unlocked(gobj);
- r = radeon_gem_handle_lockup(robj->rdev, r);
+ r = radeon_gem_handle_lockup(rdev, r);
return r;
}
--
1.7.10.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] drm/radeon: fix rare segfault
2012-07-02 16:40 [PATCH] drm/radeon: fix rare segfault j.glisse
@ 2012-07-02 20:25 ` Alex Deucher
2012-07-03 9:29 ` Christian König
1 sibling, 0 replies; 3+ messages in thread
From: Alex Deucher @ 2012-07-02 20:25 UTC (permalink / raw)
To: j.glisse; +Cc: Jerome Glisse, dri-devel
On Mon, Jul 2, 2012 at 12:40 PM, <j.glisse@gmail.com> wrote:
> From: Jerome Glisse <jglisse@redhat.com>
>
> In gem idle/busy ioctl the radeon object was derefenced after
> drm_gem_object_unreference_unlocked which in case the object
> have been destroyed lead to use of a possibly free pointer with
> possibly wrong data.
>
> Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
> ---
> drivers/gpu/drm/radeon/radeon_gem.c | 10 ++++++----
> 1 file changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
> index 74176c5..c8838fc 100644
> --- a/drivers/gpu/drm/radeon/radeon_gem.c
> +++ b/drivers/gpu/drm/radeon/radeon_gem.c
> @@ -325,6 +325,7 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void *data,
> int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
> struct drm_file *filp)
> {
> + struct radeon_device *rdev = dev->dev_private;
> struct drm_radeon_gem_busy *args = data;
> struct drm_gem_object *gobj;
> struct radeon_bo *robj;
> @@ -350,13 +351,14 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
> break;
> }
> drm_gem_object_unreference_unlocked(gobj);
> - r = radeon_gem_handle_lockup(robj->rdev, r);
> + r = radeon_gem_handle_lockup(rdev, r);
> return r;
> }
>
> int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
> struct drm_file *filp)
> {
> + struct radeon_device *rdev = dev->dev_private;
> struct drm_radeon_gem_wait_idle *args = data;
> struct drm_gem_object *gobj;
> struct radeon_bo *robj;
> @@ -369,10 +371,10 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
> robj = gem_to_radeon_bo(gobj);
> r = radeon_bo_wait(robj, NULL, false);
> /* callback hw specific functions if any */
> - if (robj->rdev->asic->ioctl_wait_idle)
> - robj->rdev->asic->ioctl_wait_idle(robj->rdev, robj);
> + if (rdev->asic->ioctl_wait_idle)
> + robj->rdev->asic->ioctl_wait_idle(rdev, robj);
> drm_gem_object_unreference_unlocked(gobj);
> - r = radeon_gem_handle_lockup(robj->rdev, r);
> + r = radeon_gem_handle_lockup(rdev, r);
> return r;
> }
>
> --
> 1.7.10.2
>
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] drm/radeon: fix rare segfault
2012-07-02 16:40 [PATCH] drm/radeon: fix rare segfault j.glisse
2012-07-02 20:25 ` Alex Deucher
@ 2012-07-03 9:29 ` Christian König
1 sibling, 0 replies; 3+ messages in thread
From: Christian König @ 2012-07-03 9:29 UTC (permalink / raw)
To: j.glisse; +Cc: Jerome Glisse, dri-devel
On 02.07.2012 18:40, j.glisse@gmail.com wrote:
> From: Jerome Glisse <jglisse@redhat.com>
>
> In gem idle/busy ioctl the radeon object was derefenced after
> drm_gem_object_unreference_unlocked which in case the object
> have been destroyed lead to use of a possibly free pointer with
> possibly wrong data.
>
> Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
> ---
> drivers/gpu/drm/radeon/radeon_gem.c | 10 ++++++----
> 1 file changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
> index 74176c5..c8838fc 100644
> --- a/drivers/gpu/drm/radeon/radeon_gem.c
> +++ b/drivers/gpu/drm/radeon/radeon_gem.c
> @@ -325,6 +325,7 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void *data,
> int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
> struct drm_file *filp)
> {
> + struct radeon_device *rdev = dev->dev_private;
> struct drm_radeon_gem_busy *args = data;
> struct drm_gem_object *gobj;
> struct radeon_bo *robj;
> @@ -350,13 +351,14 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
> break;
> }
> drm_gem_object_unreference_unlocked(gobj);
> - r = radeon_gem_handle_lockup(robj->rdev, r);
> + r = radeon_gem_handle_lockup(rdev, r);
> return r;
> }
>
> int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
> struct drm_file *filp)
> {
> + struct radeon_device *rdev = dev->dev_private;
> struct drm_radeon_gem_wait_idle *args = data;
> struct drm_gem_object *gobj;
> struct radeon_bo *robj;
> @@ -369,10 +371,10 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
> robj = gem_to_radeon_bo(gobj);
> r = radeon_bo_wait(robj, NULL, false);
> /* callback hw specific functions if any */
> - if (robj->rdev->asic->ioctl_wait_idle)
> - robj->rdev->asic->ioctl_wait_idle(robj->rdev, robj);
> + if (rdev->asic->ioctl_wait_idle)
> + robj->rdev->asic->ioctl_wait_idle(rdev, robj);
> drm_gem_object_unreference_unlocked(gobj);
> - r = radeon_gem_handle_lockup(robj->rdev, r);
> + r = radeon_gem_handle_lockup(rdev, r);
> return r;
> }
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-07-03 9:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-07-02 16:40 [PATCH] drm/radeon: fix rare segfault j.glisse
2012-07-02 20:25 ` Alex Deucher
2012-07-03 9:29 ` Christian König
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.