From: Daniel Vetter <daniel@ffwll.ch> To: Chris Wilson <chris@chris-wilson.co.uk> Cc: dri-devel@lists.freedesktop.org, David Airlie <airlied@linux.ie>, intel-gfx@lists.freedesktop.org, stable@vger.kernel.org, Daniel Vetter <daniel.vetter@intel.com>, Thierry Reding <treding@nvidia.com> Subject: Re: [Intel-gfx] [PATCH] drm: Release driver tracking before making the object available again Date: Mon, 21 Aug 2017 18:16:24 +0200 [thread overview] Message-ID: <20170821161624.myaqrevhuyrxcvj7@phenom.ffwll.local> (raw) In-Reply-To: <20170819120558.6465-1-chris@chris-wilson.co.uk> On Sat, Aug 19, 2017 at 01:05:58PM +0100, Chris Wilson wrote: > This is the same bug as we fixed in commit f6cd7daecff5 ("drm: Release > driver references to handle before making it available again"), but now > the exposure is via the PRIME lookup tables. If we remove the > object/handle from the PRIME lut, then a new request for the same > object/fd will generate a new handle, thus for a short window that > object is known to userspace by two different handles. Fix this by > releasing the driver tracking before PRIME. > > Fixes: 0ff926c7d4f0 ("drm/prime: add exported buffers to current fprivs > imported buffer list (v2)") > Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> > Cc: David Airlie <airlied@linux.ie> > Cc: Daniel Vetter <daniel.vetter@intel.com> > Cc: Rob Clark <robdclark@gmail.com> > Cc: Ville Syrj�l� <ville.syrjala@linux.intel.com> > Cc: Thierry Reding <treding@nvidia.com> > Cc: stable@vger.kernel.org Do we have an evil igt for this? I guess since the old one didn't have one, this new race is also hard to reproduce ... Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> > --- > drivers/gpu/drm/drm_gem.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c > index ad4e9cfe48a2..88c6d78ee2d5 100644 > --- a/drivers/gpu/drm/drm_gem.c > +++ b/drivers/gpu/drm/drm_gem.c > @@ -255,13 +255,13 @@ drm_gem_object_release_handle(int id, void *ptr, void *data) > struct drm_gem_object *obj = ptr; > struct drm_device *dev = obj->dev; > > + if (dev->driver->gem_close_object) > + dev->driver->gem_close_object(obj, file_priv); > + > if (drm_core_check_feature(dev, DRIVER_PRIME)) > drm_gem_remove_prime_handles(obj, file_priv); > drm_vma_node_revoke(&obj->vma_node, file_priv); > > - if (dev->driver->gem_close_object) > - dev->driver->gem_close_object(obj, file_priv); > - > drm_gem_object_handle_put_unlocked(obj); > > return 0; > -- > 2.14.1 > > _______________________________________________ > Intel-gfx mailing list > Intel-gfx@lists.freedesktop.org > https://lists.freedesktop.org/mailman/listinfo/intel-gfx -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch
WARNING: multiple messages have this Message-ID (diff)
From: Daniel Vetter <daniel@ffwll.ch> To: Chris Wilson <chris@chris-wilson.co.uk> Cc: David Airlie <airlied@linux.ie>, intel-gfx@lists.freedesktop.org, stable@vger.kernel.org, dri-devel@lists.freedesktop.org, Daniel Vetter <daniel.vetter@intel.com>, Thierry Reding <treding@nvidia.com> Subject: Re: [PATCH] drm: Release driver tracking before making the object available again Date: Mon, 21 Aug 2017 18:16:24 +0200 [thread overview] Message-ID: <20170821161624.myaqrevhuyrxcvj7@phenom.ffwll.local> (raw) In-Reply-To: <20170819120558.6465-1-chris@chris-wilson.co.uk> On Sat, Aug 19, 2017 at 01:05:58PM +0100, Chris Wilson wrote: > This is the same bug as we fixed in commit f6cd7daecff5 ("drm: Release > driver references to handle before making it available again"), but now > the exposure is via the PRIME lookup tables. If we remove the > object/handle from the PRIME lut, then a new request for the same > object/fd will generate a new handle, thus for a short window that > object is known to userspace by two different handles. Fix this by > releasing the driver tracking before PRIME. > > Fixes: 0ff926c7d4f0 ("drm/prime: add exported buffers to current fprivs > imported buffer list (v2)") > Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> > Cc: David Airlie <airlied@linux.ie> > Cc: Daniel Vetter <daniel.vetter@intel.com> > Cc: Rob Clark <robdclark@gmail.com> > Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> > Cc: Thierry Reding <treding@nvidia.com> > Cc: stable@vger.kernel.org Do we have an evil igt for this? I guess since the old one didn't have one, this new race is also hard to reproduce ... Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> > --- > drivers/gpu/drm/drm_gem.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c > index ad4e9cfe48a2..88c6d78ee2d5 100644 > --- a/drivers/gpu/drm/drm_gem.c > +++ b/drivers/gpu/drm/drm_gem.c > @@ -255,13 +255,13 @@ drm_gem_object_release_handle(int id, void *ptr, void *data) > struct drm_gem_object *obj = ptr; > struct drm_device *dev = obj->dev; > > + if (dev->driver->gem_close_object) > + dev->driver->gem_close_object(obj, file_priv); > + > if (drm_core_check_feature(dev, DRIVER_PRIME)) > drm_gem_remove_prime_handles(obj, file_priv); > drm_vma_node_revoke(&obj->vma_node, file_priv); > > - if (dev->driver->gem_close_object) > - dev->driver->gem_close_object(obj, file_priv); > - > drm_gem_object_handle_put_unlocked(obj); > > return 0; > -- > 2.14.1 > > _______________________________________________ > Intel-gfx mailing list > Intel-gfx@lists.freedesktop.org > https://lists.freedesktop.org/mailman/listinfo/intel-gfx -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch _______________________________________________ Intel-gfx mailing list Intel-gfx@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/intel-gfx
next prev parent reply other threads:[~2017-08-21 16:16 UTC|newest] Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-08-19 12:05 [PATCH] drm: Release driver tracking before making the object available again Chris Wilson 2017-08-19 12:27 ` ✓ Fi.CI.BAT: success for " Patchwork 2017-08-21 16:16 ` Daniel Vetter [this message] 2017-08-21 16:16 ` [PATCH] " Daniel Vetter 2017-08-21 16:48 ` Chris Wilson 2017-08-22 13:20 ` [Intel-gfx] " Joonas Lahtinen 2017-08-22 13:20 ` Joonas Lahtinen
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20170821161624.myaqrevhuyrxcvj7@phenom.ffwll.local \ --to=daniel@ffwll.ch \ --cc=airlied@linux.ie \ --cc=chris@chris-wilson.co.uk \ --cc=daniel.vetter@intel.com \ --cc=dri-devel@lists.freedesktop.org \ --cc=intel-gfx@lists.freedesktop.org \ --cc=stable@vger.kernel.org \ --cc=treding@nvidia.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.