Module: Mesa Branch: master Commit: 866bb22d6b91d7a12e62803bacf7d8bc912d3216 URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=866bb22d6b91d7a12e62803bacf7d8bc912d3216
Author: Lucas Stach <[email protected]> Date: Wed Oct 28 19:47:15 2020 +0100 etnaviv: drm: fix BO refcount race There is a race where the BO refcount might drop to 0 before the dmabuf/name import paths had a chance to grab a reference for a BO found in the handle_table. The easiest solution is to keep the refcount stable as long as the table_lock is held. While a more involved scheme of rechecking the refcount before actually destroying the BO might also work, the bo_del path isn't called very often, so micro-optimizing a single mutex_lock seems to be over-engineered, so go for the easy solution. Cc: <[email protected]> Signed-off-by: Lucas Stach <[email protected]> Reviewed-by: Christian Gmeiner <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/7367> --- src/etnaviv/drm/etnaviv_bo.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/etnaviv/drm/etnaviv_bo.c b/src/etnaviv/drm/etnaviv_bo.c index 0ec64b780f5..7fde304ed3b 100644 --- a/src/etnaviv/drm/etnaviv_bo.c +++ b/src/etnaviv/drm/etnaviv_bo.c @@ -257,11 +257,15 @@ void etna_bo_del(struct etna_bo *bo) struct etna_device *dev = bo->dev; - if (!p_atomic_dec_zero(&bo->refcnt)) - return; - pthread_mutex_lock(&etna_drm_table_lock); + /* Must test under table lock to avoid racing with the from_dmabuf/name + * paths, which rely on the BO refcount to be stable over the lookup, so + * they can grab a reference when the BO is found in the hash. + */ + if (!p_atomic_dec_zero(&bo->refcnt)) + goto out; + if (bo->reuse && (etna_bo_cache_free(&dev->bo_cache, bo) == 0)) goto out; _______________________________________________ mesa-commit mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/mesa-commit
