drm/msm: Protect obj->active_count under obj lock

Browse source

Previously we only held obj lock in the _active_get() path, and relied
on atomic_dec_return() to not be racy in the _active_put() path where
obj lock was not held.

But this is a false sense of security.  Unlike obj lifetime refcnt,
where you do not expect to *increase* the refcnt after the last put
(which would mean that something has gone horribly wrong with the
object liveness reference counting), the active_count can increase
again from zero.  Racing _active_put()s and _active_get()s could leave
the obj on the wrong mm list.

But in the retire path, immediately after the _active_put(), the
_unpin_iova() would acquire obj lock.  So just move the locking earlier
and rely on that to protect obj->active_count.

Fixes: c5c1643cef ("drm/msm: Drop struct_mutex from the retire path")
Signed-off-by: Rob Clark <robdclark@chromium.org>

...

This commit is contained in:

Rob Clark 2020-11-16 09:48:49 -08:00

parent e8c765811b

commit ab5c54cb88

3 changed files with 15 additions and 11 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

11

drivers/gpu/drm/msm/msm_gem.c

View file

5

drivers/gpu/drm/msm/msm_gem.h

View file

10

drivers/gpu/drm/msm/msm_gpu.c

View file