Re: [RFC 4/7] drm/prime: Clear drm_gem_object->dma_buf on release

From: "Noralf Trønnes" <noralf@tronnes.org>
To: Chris Wilson <chris@chris-wilson.co.uk>, dri-devel@lists.freedesktop.org
Cc: daniel.vetter@ffwll.ch, intel-gfx@lists.freedesktop.org,
	laurent.pinchart@ideasonboard.com, dh.herrmann@gmail.com
Subject: Re: [RFC 4/7] drm/prime: Clear drm_gem_object->dma_buf on release
Date: Mon, 1 Jan 2018 15:33:10 +0100	[thread overview]
Message-ID: <beb7899e-fa9a-68e7-21a9-bf5dfa11aea8@tronnes.org> (raw)
In-Reply-To: <151473488770.2051.15717714514432460668@mail.alporthouse.com>

Den 31.12.2017 16.41, skrev Chris Wilson:
> Quoting Noralf Trønnes (2017-12-31 13:58:40)
>> Clear the pointer so the buffer can be re-exported. Otherwise use
>> after free happens in the next call to drm_gem_prime_handle_to_fd().
>>
>> Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
>> ---
>>   drivers/gpu/drm/drm_prime.c | 1 +
>>   1 file changed, 1 insertion(+)
>>
>> diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
>> index 9a17725b0f7a..3214c0eb7466 100644
>> --- a/drivers/gpu/drm/drm_prime.c
>> +++ b/drivers/gpu/drm/drm_prime.c
>> @@ -343,6 +343,7 @@ void drm_gem_dmabuf_release(struct dma_buf *dma_buf)
>>   
>>          /* drop the reference on the export fd holds */
>>          drm_gem_object_put_unlocked(obj);
>> +       obj->dma_buf = NULL;
> obj->dma_buf holds a reference to the dma_buf, so to get to the dma_buf
> release we must have already called dma_buf_put(obj->dma_buf). See
> drm_gem_object_exported_dma_buf_free(). (Note you would do the
> obj->dma_buf = NULL before dropping the potentially last ref to obj.)
> A BUG_ON(obj->dma_buf) may help clarify the cache was already released.

Hmm, okay it was a shot in the dark.
Maybe I can defer dumb_buffer and drm_framebuffer creation until fb_open
and then free it all in fb_close. That would align fbdev emulation more
with how DRM userspace operates. Let's see what assumptions the code has
about drm_fb_helper->fb being set on probe...

Noralf.

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx