]> git.baikalelectronics.ru Git - kernel.git/commit
drm/i915: Fix a use after free, and unbalanced refcounting
authorNick Hoath <nicholas.hoath@intel.com>
Thu, 19 Feb 2015 16:30:47 +0000 (16:30 +0000)
committerJani Nikula <jani.nikula@intel.com>
Tue, 24 Feb 2015 13:18:37 +0000 (15:18 +0200)
commite83660ed6dc2203e1d2fb891fcbac69705c76a0f
tree3612480a749cff000edb42f7e6be269ba05f56fd
parent6983b587dd76c0103d6a75203cc8e8a4b6e6416a
drm/i915: Fix a use after free, and unbalanced refcounting

When converting from implicitly tracked execlist queue items to ref counted
requests, not all frees of requests were replaced with unrefs, and extraneous
refs/unrefs of contexts were added.
Correct the unbalanced refcount & replace the frees.
Remove a noisy warning when hitting the request creation path.

drm_i915_gem_request and intel_context are both kref reference counted
structures. Upon allocation, drm_i915_gem_request's ref count should be
bumped using kref_init. When a context is assigned to the request,
the context's reference count should be bumped using i915_gem_context_reference.
i915_gem_request_reference will reduce the context reference count when
the request is freed.

Problem introduced in
commit 01a723e38850e7355c660572998b064b953f2832
Author:     Nick Hoath <nicholas.hoath@intel.com>
AuthorDate: Thu Jan 15 13:10:39 2015 +0000

     drm/i915: Subsume intel_ctx_submit_request in to drm_i915_gem_request

v2: Added comments explaining how the ctx pointer and the request object should
be ref-counted. Removed noisy warning.

v3: Cleaned up the language used in the commit & the header
description (Thanks David Gordon)

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=88652
Signed-off-by: Nick Hoath <nicholas.hoath@intel.com>
Reviewed-by: Thomas Daniel <thomas.daniel@intel.com>
Reviewed-by: Daniel Vetter <daniel@ffwll.ch>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
drivers/gpu/drm/i915/i915_drv.h
drivers/gpu/drm/i915/i915_gem.c
drivers/gpu/drm/i915/intel_lrc.c