From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755455AbdDEQ3w (ORCPT ); Wed, 5 Apr 2017 12:29:52 -0400 Received: from mail-qt0-f179.google.com ([209.85.216.179]:36091 "EHLO mail-qt0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752981AbdDEQ2n (ORCPT ); Wed, 5 Apr 2017 12:28:43 -0400 Date: Wed, 5 Apr 2017 12:28:40 -0400 From: Sean Paul To: Jeffy Chen Cc: linux-kernel@vger.kernel.org, briannorris@chromium.org, dianders@chromium.org, tfiga@chromium.org, seanpaul@chromium.org, zyw@rock-chips.com, mark.yao@rock-chips.com, Heiko Stuebner , dri-devel@lists.freedesktop.org, linux-rockchip@lists.infradead.org, David Airlie , linux-arm-kernel@lists.infradead.org Subject: Re: [PATCH v3 8/9] drm/rockchip: gem: Don't alloc/free gem buf when dev_private is invalid Message-ID: <20170405162839.k6q4b3tpt6t2s3zm@art_vandelay> References: <1491380967-28570-1-git-send-email-jeffy.chen@rock-chips.com> <1491380967-28570-9-git-send-email-jeffy.chen@rock-chips.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1491380967-28570-9-git-send-email-jeffy.chen@rock-chips.com> User-Agent: NeoMutt/20170306-66-6ddb52-dirty (1.8.0) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Apr 05, 2017 at 04:29:26PM +0800, Jeffy Chen wrote: > After unbinding drm, the userspace may still has a chance to access > gem buf. > > Add a sanity check for a NULL dev_private to prevent that from > happening. I still don't understand how this is happening. You're saying that these hooks can be called after rockchip_drm_unbind() has finished? Sean > > Signed-off-by: Jeffy Chen > --- > > Changes in v3: > Address Daniel Vetter 's comments. > Update commit message. > > Changes in v2: None > > drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > index df9e570..205a3dc 100644 > --- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > +++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > @@ -184,6 +184,9 @@ static int rockchip_gem_alloc_buf(struct rockchip_gem_object *rk_obj, > struct drm_device *drm = obj->dev; > struct rockchip_drm_private *private = drm->dev_private; > > + if (!private) > + return -ENODEV; > + > if (private->domain) > return rockchip_gem_alloc_iommu(rk_obj, alloc_kmap); > else > @@ -208,6 +211,11 @@ static void rockchip_gem_free_dma(struct rockchip_gem_object *rk_obj) > > static void rockchip_gem_free_buf(struct rockchip_gem_object *rk_obj) > { > + struct drm_device *drm = rk_obj->base.dev; > + > + if (!drm->dev_private) > + return; > + > if (rk_obj->pages) > rockchip_gem_free_iommu(rk_obj); > else > -- > 2.1.4 > -- Sean Paul, Software Engineer, Google / Chromium OS From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sean Paul Subject: Re: [PATCH v3 8/9] drm/rockchip: gem: Don't alloc/free gem buf when dev_private is invalid Date: Wed, 5 Apr 2017 12:28:40 -0400 Message-ID: <20170405162839.k6q4b3tpt6t2s3zm@art_vandelay> References: <1491380967-28570-1-git-send-email-jeffy.chen@rock-chips.com> <1491380967-28570-9-git-send-email-jeffy.chen@rock-chips.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Content-Disposition: inline In-Reply-To: <1491380967-28570-9-git-send-email-jeffy.chen@rock-chips.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Jeffy Chen Cc: dianders@chromium.org, briannorris@chromium.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, tfiga@chromium.org, linux-rockchip@lists.infradead.org, zyw@rock-chips.com, linux-arm-kernel@lists.infradead.org List-Id: linux-rockchip.vger.kernel.org T24gV2VkLCBBcHIgMDUsIDIwMTcgYXQgMDQ6Mjk6MjZQTSArMDgwMCwgSmVmZnkgQ2hlbiB3cm90 ZToKPiBBZnRlciB1bmJpbmRpbmcgZHJtLCB0aGUgdXNlcnNwYWNlIG1heSBzdGlsbCBoYXMgYSBj aGFuY2UgdG8gYWNjZXNzCj4gZ2VtIGJ1Zi4KPiAKPiBBZGQgYSBzYW5pdHkgY2hlY2sgZm9yIGEg TlVMTCBkZXZfcHJpdmF0ZSB0byBwcmV2ZW50IHRoYXQgZnJvbQo+IGhhcHBlbmluZy4KCkkgc3Rp bGwgZG9uJ3QgdW5kZXJzdGFuZCBob3cgdGhpcyBpcyBoYXBwZW5pbmcuIFlvdSdyZSBzYXlpbmcg dGhhdCB0aGVzZSBob29rcwpjYW4gYmUgY2FsbGVkIGFmdGVyIHJvY2tjaGlwX2RybV91bmJpbmQo KSBoYXMgZmluaXNoZWQ/IAoKU2VhbgoKPiAKPiBTaWduZWQtb2ZmLWJ5OiBKZWZmeSBDaGVuIDxq ZWZmeS5jaGVuQHJvY2stY2hpcHMuY29tPgo+IC0tLQo+IAo+IENoYW5nZXMgaW4gdjM6Cj4gQWRk cmVzcyBEYW5pZWwgVmV0dGVyIDxkYW5pZWxAZmZ3bGwuY2g+J3MgY29tbWVudHMuCj4gVXBkYXRl IGNvbW1pdCBtZXNzYWdlLgo+IAo+IENoYW5nZXMgaW4gdjI6IE5vbmUKPiAKPiAgZHJpdmVycy9n cHUvZHJtL3JvY2tjaGlwL3JvY2tjaGlwX2RybV9nZW0uYyB8IDggKysrKysrKysKPiAgMSBmaWxl IGNoYW5nZWQsIDggaW5zZXJ0aW9ucygrKQo+IAo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL2dwdS9k cm0vcm9ja2NoaXAvcm9ja2NoaXBfZHJtX2dlbS5jIGIvZHJpdmVycy9ncHUvZHJtL3JvY2tjaGlw L3JvY2tjaGlwX2RybV9nZW0uYwo+IGluZGV4IGRmOWU1NzAuLjIwNWEzZGMgMTAwNjQ0Cj4gLS0t IGEvZHJpdmVycy9ncHUvZHJtL3JvY2tjaGlwL3JvY2tjaGlwX2RybV9nZW0uYwo+ICsrKyBiL2Ry aXZlcnMvZ3B1L2RybS9yb2NrY2hpcC9yb2NrY2hpcF9kcm1fZ2VtLmMKPiBAQCAtMTg0LDYgKzE4 NCw5IEBAIHN0YXRpYyBpbnQgcm9ja2NoaXBfZ2VtX2FsbG9jX2J1ZihzdHJ1Y3Qgcm9ja2NoaXBf Z2VtX29iamVjdCAqcmtfb2JqLAo+ICAJc3RydWN0IGRybV9kZXZpY2UgKmRybSA9IG9iai0+ZGV2 Owo+ICAJc3RydWN0IHJvY2tjaGlwX2RybV9wcml2YXRlICpwcml2YXRlID0gZHJtLT5kZXZfcHJp dmF0ZTsKPiAgCj4gKwlpZiAoIXByaXZhdGUpCj4gKwkJcmV0dXJuIC1FTk9ERVY7Cj4gKwo+ICAJ aWYgKHByaXZhdGUtPmRvbWFpbikKPiAgCQlyZXR1cm4gcm9ja2NoaXBfZ2VtX2FsbG9jX2lvbW11 KHJrX29iaiwgYWxsb2Nfa21hcCk7Cj4gIAllbHNlCj4gQEAgLTIwOCw2ICsyMTEsMTEgQEAgc3Rh dGljIHZvaWQgcm9ja2NoaXBfZ2VtX2ZyZWVfZG1hKHN0cnVjdCByb2NrY2hpcF9nZW1fb2JqZWN0 ICpya19vYmopCj4gIAo+ICBzdGF0aWMgdm9pZCByb2NrY2hpcF9nZW1fZnJlZV9idWYoc3RydWN0 IHJvY2tjaGlwX2dlbV9vYmplY3QgKnJrX29iaikKPiAgewo+ICsJc3RydWN0IGRybV9kZXZpY2Ug KmRybSA9IHJrX29iai0+YmFzZS5kZXY7Cj4gKwo+ICsJaWYgKCFkcm0tPmRldl9wcml2YXRlKQo+ ICsJCXJldHVybjsKPiArCj4gIAlpZiAocmtfb2JqLT5wYWdlcykKPiAgCQlyb2NrY2hpcF9nZW1f ZnJlZV9pb21tdShya19vYmopOwo+ICAJZWxzZQo+IC0tIAo+IDIuMS40Cj4gCgotLSAKU2VhbiBQ YXVsLCBTb2Z0d2FyZSBFbmdpbmVlciwgR29vZ2xlIC8gQ2hyb21pdW0gT1MKX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVsIG1haWxpbmcgbGlz dApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlzdHMuZnJlZWRlc2t0 b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRldmVsCg== From mboxrd@z Thu Jan 1 00:00:00 1970 From: seanpaul@chromium.org (Sean Paul) Date: Wed, 5 Apr 2017 12:28:40 -0400 Subject: [PATCH v3 8/9] drm/rockchip: gem: Don't alloc/free gem buf when dev_private is invalid In-Reply-To: <1491380967-28570-9-git-send-email-jeffy.chen@rock-chips.com> References: <1491380967-28570-1-git-send-email-jeffy.chen@rock-chips.com> <1491380967-28570-9-git-send-email-jeffy.chen@rock-chips.com> Message-ID: <20170405162839.k6q4b3tpt6t2s3zm@art_vandelay> To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On Wed, Apr 05, 2017 at 04:29:26PM +0800, Jeffy Chen wrote: > After unbinding drm, the userspace may still has a chance to access > gem buf. > > Add a sanity check for a NULL dev_private to prevent that from > happening. I still don't understand how this is happening. You're saying that these hooks can be called after rockchip_drm_unbind() has finished? Sean > > Signed-off-by: Jeffy Chen > --- > > Changes in v3: > Address Daniel Vetter 's comments. > Update commit message. > > Changes in v2: None > > drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > index df9e570..205a3dc 100644 > --- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > +++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > @@ -184,6 +184,9 @@ static int rockchip_gem_alloc_buf(struct rockchip_gem_object *rk_obj, > struct drm_device *drm = obj->dev; > struct rockchip_drm_private *private = drm->dev_private; > > + if (!private) > + return -ENODEV; > + > if (private->domain) > return rockchip_gem_alloc_iommu(rk_obj, alloc_kmap); > else > @@ -208,6 +211,11 @@ static void rockchip_gem_free_dma(struct rockchip_gem_object *rk_obj) > > static void rockchip_gem_free_buf(struct rockchip_gem_object *rk_obj) > { > + struct drm_device *drm = rk_obj->base.dev; > + > + if (!drm->dev_private) > + return; > + > if (rk_obj->pages) > rockchip_gem_free_iommu(rk_obj); > else > -- > 2.1.4 > -- Sean Paul, Software Engineer, Google / Chromium OS