All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 1/4] drm/v3d: Fix a use-after-free race accessing the scheduler's fences.
@ 2018-09-28 23:21 Eric Anholt
  2018-09-28 23:21   ` Eric Anholt
                   ` (3 more replies)
  0 siblings, 4 replies; 13+ messages in thread
From: Eric Anholt @ 2018-09-28 23:21 UTC (permalink / raw)
  To: dri-devel; +Cc: linux-kernel, boris.brezillon, Eric Anholt

Once we push the job, the scheduler could run it and free it.  So, if
we want to reference their fences, we need to grab them before then.
I haven't seen this happen in many days of conformance test runtime,
but let's still close the race.

Signed-off-by: Eric Anholt <eric@anholt.net>
Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+")
---
 drivers/gpu/drm/v3d/v3d_drv.h | 5 +++++
 drivers/gpu/drm/v3d/v3d_gem.c | 8 ++++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h
index 5042573e97f4..83c55ab6e1c0 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.h
+++ b/drivers/gpu/drm/v3d/v3d_drv.h
@@ -204,6 +204,11 @@ struct v3d_exec_info {
 	 */
 	struct dma_fence *bin_done_fence;
 
+	/* Fence for when the scheduler considers the render to be
+	 * done, for when the BOs reservations should be complete.
+	 */
+	struct dma_fence *render_done_fence;
+
 	struct kref refcount;
 
 	/* This is the array of BOs that were looked up at the start of exec. */
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index e1fcbb4cd0ae..c98fbfbdb68e 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -209,7 +209,7 @@ v3d_flush_caches(struct v3d_dev *v3d)
 static void
 v3d_attach_object_fences(struct v3d_exec_info *exec)
 {
-	struct dma_fence *out_fence = &exec->render.base.s_fence->finished;
+	struct dma_fence *out_fence = exec->render_done_fence;
 	struct v3d_bo *bo;
 	int i;
 
@@ -409,6 +409,7 @@ v3d_exec_cleanup(struct kref *ref)
 	dma_fence_put(exec->render.done_fence);
 
 	dma_fence_put(exec->bin_done_fence);
+	dma_fence_put(exec->render_done_fence);
 
 	for (i = 0; i < exec->bo_count; i++)
 		drm_gem_object_put_unlocked(&exec->bo[i]->base);
@@ -574,6 +575,9 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 	if (ret)
 		goto fail_unreserve;
 
+	exec->render_done_fence =
+		dma_fence_get(&exec->render.base.s_fence->finished);
+
 	kref_get(&exec->refcount); /* put by scheduler job completion */
 	drm_sched_entity_push_job(&exec->render.base,
 				  &v3d_priv->sched_entity[V3D_RENDER]);
@@ -587,7 +591,7 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 	sync_out = drm_syncobj_find(file_priv, args->out_sync);
 	if (sync_out) {
 		drm_syncobj_replace_fence(sync_out,
-					  &exec->render.base.s_fence->finished);
+					  exec->render_done_fence);
 		drm_syncobj_put(sync_out);
 	}
 
-- 
2.18.0


^ permalink raw reply related	[flat|nested] 13+ messages in thread

end of thread, other threads:[~2018-10-09 13:30 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-09-28 23:21 [PATCH 1/4] drm/v3d: Fix a use-after-free race accessing the scheduler's fences Eric Anholt
2018-09-28 23:21 ` [PATCH 2/4] drm/v3d: Add a little debugfs entry for measuring the core clock Eric Anholt
2018-09-28 23:21   ` Eric Anholt
2018-10-09 13:26   ` Boris Brezillon
2018-10-09 13:26     ` Boris Brezillon
2018-09-28 23:21 ` [PATCH 3/4] drm/v3d: Add some better documentation of the in_sync arguments Eric Anholt
2018-10-09 13:27   ` Boris Brezillon
2018-10-09 13:27     ` Boris Brezillon
2018-09-28 23:21 ` [PATCH 4/4] drm/v3d: Skip debugfs dumping GCA on platforms without GCA Eric Anholt
2018-09-28 23:21   ` Eric Anholt
2018-10-09 13:30   ` Boris Brezillon
2018-10-09 13:30     ` Boris Brezillon
2018-10-08 13:46 ` [PATCH 1/4] drm/v3d: Fix a use-after-free race accessing the scheduler's fences Boris Brezillon

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.