* [PATCH] drm/syncobj: Stop reusing the same struct file for all syncobj -> fd
@ 2018-03-26 19:00 Jason Ekstrand
2018-03-27 6:37 ` Jani Nikula
2018-03-27 7:29 ` Greg KH
0 siblings, 2 replies; 8+ messages in thread
From: Jason Ekstrand @ 2018-03-26 19:00 UTC (permalink / raw)
To: stable, dri-devel; +Cc: Chris Wilson, Dave Airlie, Jason Ekstrand
From: Chris Wilson <chris@chris-wilson.co.uk>
The vk cts test:
dEQP-VK.api.external.semaphore.opaque_fd.export_multiple_times_temporary
triggers a lot of
VFS: Close: file count is 0
Dave pointed out that clearing the syncobj->file from
drm_syncobj_file_release() was sufficient to silence the test, but that
opens a can of worm since we assumed that the syncobj->file was never
unset. Stop trying to reuse the same struct file for every fd pointing
to the drm_syncobj, and allocate one file for each fd instead.
v2: Fixup return handling of drm_syncobj_fd_to_handle
v2.1: [airlied: fix possible syncobj ref race]
v2.2: [jekstrand: back-port to 4.14]
Reported-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Tested-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Jason Ekstrand <jason@jlekstrand.net>
Tested-by: Clayton Craft <clayton.a.craft@intel.com>
---
The back-port from 4.15 to 4.14 was non-trivial. It'd be good if Chris and
maybe Daniel could do a quick re-review.
drivers/gpu/drm/drm_syncobj.c | 81 ++++++++++++++++---------------------------
include/drm/drm_syncobj.h | 5 ---
2 files changed, 30 insertions(+), 56 deletions(-)
diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index 0422b8c..7bcf570 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -328,28 +328,11 @@ static const struct file_operations drm_syncobj_file_fops = {
.release = drm_syncobj_file_release,
};
-static int drm_syncobj_alloc_file(struct drm_syncobj *syncobj)
-{
- struct file *file = anon_inode_getfile("syncobj_file",
- &drm_syncobj_file_fops,
- syncobj, 0);
- if (IS_ERR(file))
- return PTR_ERR(file);
-
- drm_syncobj_get(syncobj);
- if (cmpxchg(&syncobj->file, NULL, file)) {
- /* lost the race */
- fput(file);
- }
-
- return 0;
-}
-
static int drm_syncobj_handle_to_fd(struct drm_file *file_private,
u32 handle, int *p_fd)
{
struct drm_syncobj *syncobj = drm_syncobj_find(file_private, handle);
- int ret;
+ struct file *file;
int fd;
if (!syncobj)
@@ -361,46 +344,40 @@ static int drm_syncobj_handle_to_fd(struct drm_file *file_private,
return fd;
}
- if (!syncobj->file) {
- ret = drm_syncobj_alloc_file(syncobj);
- if (ret)
- goto out_put_fd;
+ file = anon_inode_getfile("syncobj_file",
+ &drm_syncobj_file_fops,
+ syncobj, 0);
+ if (IS_ERR(file)) {
+ put_unused_fd(fd);
+ drm_syncobj_put(syncobj);
+ return PTR_ERR(file);
}
- fd_install(fd, syncobj->file);
- drm_syncobj_put(syncobj);
+
+ drm_syncobj_get(syncobj);
+ fd_install(fd, file);
+
*p_fd = fd;
return 0;
-out_put_fd:
- put_unused_fd(fd);
- drm_syncobj_put(syncobj);
- return ret;
}
-static struct drm_syncobj *drm_syncobj_fdget(int fd)
-{
- struct file *file = fget(fd);
-
- if (!file)
- return NULL;
- if (file->f_op != &drm_syncobj_file_fops)
- goto err;
-
- return file->private_data;
-err:
- fput(file);
- return NULL;
-};
-
static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
int fd, u32 *handle)
{
- struct drm_syncobj *syncobj = drm_syncobj_fdget(fd);
+ struct drm_syncobj *syncobj;
+ struct file *file;
int ret;
- if (!syncobj)
+ file = fget(fd);
+ if (!file)
+ return -EINVAL;
+
+ if (file->f_op != &drm_syncobj_file_fops) {
+ fput(file);
return -EINVAL;
+ }
/* take a reference to put in the idr */
+ syncobj = file->private_data;
drm_syncobj_get(syncobj);
idr_preload(GFP_KERNEL);
@@ -409,12 +386,14 @@ static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
spin_unlock(&file_private->syncobj_table_lock);
idr_preload_end();
- if (ret < 0) {
- fput(syncobj->file);
- return ret;
- }
- *handle = ret;
- return 0;
+ if (ret > 0) {
+ *handle = ret;
+ ret = 0;
+ } else
+ drm_syncobj_put(syncobj);
+
+ fput(file);
+ return ret;
}
int drm_syncobj_import_sync_file_fence(struct drm_file *file_private,
diff --git a/include/drm/drm_syncobj.h b/include/drm/drm_syncobj.h
index c00fee5..6d45aae 100644
--- a/include/drm/drm_syncobj.h
+++ b/include/drm/drm_syncobj.h
@@ -60,11 +60,6 @@ struct drm_syncobj {
* locks cb_list and write-locks fence.
*/
spinlock_t lock;
- /**
- * @file:
- * a file backing for this syncobj.
- */
- struct file *file;
};
typedef void (*drm_syncobj_func_t)(struct drm_syncobj *syncobj,
--
2.5.0.400.gff86faf
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH] drm/syncobj: Stop reusing the same struct file for all syncobj -> fd
2018-03-26 19:00 [PATCH] drm/syncobj: Stop reusing the same struct file for all syncobj -> fd Jason Ekstrand
@ 2018-03-27 6:37 ` Jani Nikula
2018-03-27 7:29 ` Greg KH
1 sibling, 0 replies; 8+ messages in thread
From: Jani Nikula @ 2018-03-27 6:37 UTC (permalink / raw)
To: stable, dri-devel; +Cc: Dave Airlie, Jason Ekstrand
commit e7cdf5c82f1773c3386b93bbcf13b9bfff29fa31 upstream.
BR,
Jani.
On Mon, 26 Mar 2018, Jason Ekstrand <jason@jlekstrand.net> wrote:
> From: Chris Wilson <chris@chris-wilson.co.uk>
>
> The vk cts test:
> dEQP-VK.api.external.semaphore.opaque_fd.export_multiple_times_temporary
>
> triggers a lot of
> VFS: Close: file count is 0
>
> Dave pointed out that clearing the syncobj->file from
> drm_syncobj_file_release() was sufficient to silence the test, but that
> opens a can of worm since we assumed that the syncobj->file was never
> unset. Stop trying to reuse the same struct file for every fd pointing
> to the drm_syncobj, and allocate one file for each fd instead.
>
> v2: Fixup return handling of drm_syncobj_fd_to_handle
> v2.1: [airlied: fix possible syncobj ref race]
> v2.2: [jekstrand: back-port to 4.14]
>
> Reported-by: Dave Airlie <airlied@redhat.com>
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Tested-by: Dave Airlie <airlied@redhat.com>
> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> Signed-off-by: Dave Airlie <airlied@redhat.com>
> Signed-off-by: Jason Ekstrand <jason@jlekstrand.net>
> Tested-by: Clayton Craft <clayton.a.craft@intel.com>
> ---
>
> The back-port from 4.15 to 4.14 was non-trivial. It'd be good if Chris and
> maybe Daniel could do a quick re-review.
>
> drivers/gpu/drm/drm_syncobj.c | 81 ++++++++++++++++---------------------------
> include/drm/drm_syncobj.h | 5 ---
> 2 files changed, 30 insertions(+), 56 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
> index 0422b8c..7bcf570 100644
> --- a/drivers/gpu/drm/drm_syncobj.c
> +++ b/drivers/gpu/drm/drm_syncobj.c
> @@ -328,28 +328,11 @@ static const struct file_operations drm_syncobj_file_fops = {
> .release = drm_syncobj_file_release,
> };
>
> -static int drm_syncobj_alloc_file(struct drm_syncobj *syncobj)
> -{
> - struct file *file = anon_inode_getfile("syncobj_file",
> - &drm_syncobj_file_fops,
> - syncobj, 0);
> - if (IS_ERR(file))
> - return PTR_ERR(file);
> -
> - drm_syncobj_get(syncobj);
> - if (cmpxchg(&syncobj->file, NULL, file)) {
> - /* lost the race */
> - fput(file);
> - }
> -
> - return 0;
> -}
> -
> static int drm_syncobj_handle_to_fd(struct drm_file *file_private,
> u32 handle, int *p_fd)
> {
> struct drm_syncobj *syncobj = drm_syncobj_find(file_private, handle);
> - int ret;
> + struct file *file;
> int fd;
>
> if (!syncobj)
> @@ -361,46 +344,40 @@ static int drm_syncobj_handle_to_fd(struct drm_file *file_private,
> return fd;
> }
>
> - if (!syncobj->file) {
> - ret = drm_syncobj_alloc_file(syncobj);
> - if (ret)
> - goto out_put_fd;
> + file = anon_inode_getfile("syncobj_file",
> + &drm_syncobj_file_fops,
> + syncobj, 0);
> + if (IS_ERR(file)) {
> + put_unused_fd(fd);
> + drm_syncobj_put(syncobj);
> + return PTR_ERR(file);
> }
> - fd_install(fd, syncobj->file);
> - drm_syncobj_put(syncobj);
> +
> + drm_syncobj_get(syncobj);
> + fd_install(fd, file);
> +
> *p_fd = fd;
> return 0;
> -out_put_fd:
> - put_unused_fd(fd);
> - drm_syncobj_put(syncobj);
> - return ret;
> }
>
> -static struct drm_syncobj *drm_syncobj_fdget(int fd)
> -{
> - struct file *file = fget(fd);
> -
> - if (!file)
> - return NULL;
> - if (file->f_op != &drm_syncobj_file_fops)
> - goto err;
> -
> - return file->private_data;
> -err:
> - fput(file);
> - return NULL;
> -};
> -
> static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
> int fd, u32 *handle)
> {
> - struct drm_syncobj *syncobj = drm_syncobj_fdget(fd);
> + struct drm_syncobj *syncobj;
> + struct file *file;
> int ret;
>
> - if (!syncobj)
> + file = fget(fd);
> + if (!file)
> + return -EINVAL;
> +
> + if (file->f_op != &drm_syncobj_file_fops) {
> + fput(file);
> return -EINVAL;
> + }
>
> /* take a reference to put in the idr */
> + syncobj = file->private_data;
> drm_syncobj_get(syncobj);
>
> idr_preload(GFP_KERNEL);
> @@ -409,12 +386,14 @@ static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
> spin_unlock(&file_private->syncobj_table_lock);
> idr_preload_end();
>
> - if (ret < 0) {
> - fput(syncobj->file);
> - return ret;
> - }
> - *handle = ret;
> - return 0;
> + if (ret > 0) {
> + *handle = ret;
> + ret = 0;
> + } else
> + drm_syncobj_put(syncobj);
> +
> + fput(file);
> + return ret;
> }
>
> int drm_syncobj_import_sync_file_fence(struct drm_file *file_private,
> diff --git a/include/drm/drm_syncobj.h b/include/drm/drm_syncobj.h
> index c00fee5..6d45aae 100644
> --- a/include/drm/drm_syncobj.h
> +++ b/include/drm/drm_syncobj.h
> @@ -60,11 +60,6 @@ struct drm_syncobj {
> * locks cb_list and write-locks fence.
> */
> spinlock_t lock;
> - /**
> - * @file:
> - * a file backing for this syncobj.
> - */
> - struct file *file;
> };
>
> typedef void (*drm_syncobj_func_t)(struct drm_syncobj *syncobj,
--
Jani Nikula, Intel Open Source Technology Center
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] drm/syncobj: Stop reusing the same struct file for all syncobj -> fd
@ 2018-03-27 6:37 ` Jani Nikula
0 siblings, 0 replies; 8+ messages in thread
From: Jani Nikula @ 2018-03-27 6:37 UTC (permalink / raw)
To: Jason Ekstrand, stable, dri-devel; +Cc: Dave Airlie, Jason Ekstrand
commit e7cdf5c82f1773c3386b93bbcf13b9bfff29fa31 upstream.
BR,
Jani.
On Mon, 26 Mar 2018, Jason Ekstrand <jason@jlekstrand.net> wrote:
> From: Chris Wilson <chris@chris-wilson.co.uk>
>
> The vk cts test:
> dEQP-VK.api.external.semaphore.opaque_fd.export_multiple_times_temporary
>
> triggers a lot of
> VFS: Close: file count is 0
>
> Dave pointed out that clearing the syncobj->file from
> drm_syncobj_file_release() was sufficient to silence the test, but that
> opens a can of worm since we assumed that the syncobj->file was never
> unset. Stop trying to reuse the same struct file for every fd pointing
> to the drm_syncobj, and allocate one file for each fd instead.
>
> v2: Fixup return handling of drm_syncobj_fd_to_handle
> v2.1: [airlied: fix possible syncobj ref race]
> v2.2: [jekstrand: back-port to 4.14]
>
> Reported-by: Dave Airlie <airlied@redhat.com>
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Tested-by: Dave Airlie <airlied@redhat.com>
> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> Signed-off-by: Dave Airlie <airlied@redhat.com>
> Signed-off-by: Jason Ekstrand <jason@jlekstrand.net>
> Tested-by: Clayton Craft <clayton.a.craft@intel.com>
> ---
>
> The back-port from 4.15 to 4.14 was non-trivial. It'd be good if Chris and
> maybe Daniel could do a quick re-review.
>
> drivers/gpu/drm/drm_syncobj.c | 81 ++++++++++++++++---------------------------
> include/drm/drm_syncobj.h | 5 ---
> 2 files changed, 30 insertions(+), 56 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
> index 0422b8c..7bcf570 100644
> --- a/drivers/gpu/drm/drm_syncobj.c
> +++ b/drivers/gpu/drm/drm_syncobj.c
> @@ -328,28 +328,11 @@ static const struct file_operations drm_syncobj_file_fops = {
> .release = drm_syncobj_file_release,
> };
>
> -static int drm_syncobj_alloc_file(struct drm_syncobj *syncobj)
> -{
> - struct file *file = anon_inode_getfile("syncobj_file",
> - &drm_syncobj_file_fops,
> - syncobj, 0);
> - if (IS_ERR(file))
> - return PTR_ERR(file);
> -
> - drm_syncobj_get(syncobj);
> - if (cmpxchg(&syncobj->file, NULL, file)) {
> - /* lost the race */
> - fput(file);
> - }
> -
> - return 0;
> -}
> -
> static int drm_syncobj_handle_to_fd(struct drm_file *file_private,
> u32 handle, int *p_fd)
> {
> struct drm_syncobj *syncobj = drm_syncobj_find(file_private, handle);
> - int ret;
> + struct file *file;
> int fd;
>
> if (!syncobj)
> @@ -361,46 +344,40 @@ static int drm_syncobj_handle_to_fd(struct drm_file *file_private,
> return fd;
> }
>
> - if (!syncobj->file) {
> - ret = drm_syncobj_alloc_file(syncobj);
> - if (ret)
> - goto out_put_fd;
> + file = anon_inode_getfile("syncobj_file",
> + &drm_syncobj_file_fops,
> + syncobj, 0);
> + if (IS_ERR(file)) {
> + put_unused_fd(fd);
> + drm_syncobj_put(syncobj);
> + return PTR_ERR(file);
> }
> - fd_install(fd, syncobj->file);
> - drm_syncobj_put(syncobj);
> +
> + drm_syncobj_get(syncobj);
> + fd_install(fd, file);
> +
> *p_fd = fd;
> return 0;
> -out_put_fd:
> - put_unused_fd(fd);
> - drm_syncobj_put(syncobj);
> - return ret;
> }
>
> -static struct drm_syncobj *drm_syncobj_fdget(int fd)
> -{
> - struct file *file = fget(fd);
> -
> - if (!file)
> - return NULL;
> - if (file->f_op != &drm_syncobj_file_fops)
> - goto err;
> -
> - return file->private_data;
> -err:
> - fput(file);
> - return NULL;
> -};
> -
> static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
> int fd, u32 *handle)
> {
> - struct drm_syncobj *syncobj = drm_syncobj_fdget(fd);
> + struct drm_syncobj *syncobj;
> + struct file *file;
> int ret;
>
> - if (!syncobj)
> + file = fget(fd);
> + if (!file)
> + return -EINVAL;
> +
> + if (file->f_op != &drm_syncobj_file_fops) {
> + fput(file);
> return -EINVAL;
> + }
>
> /* take a reference to put in the idr */
> + syncobj = file->private_data;
> drm_syncobj_get(syncobj);
>
> idr_preload(GFP_KERNEL);
> @@ -409,12 +386,14 @@ static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
> spin_unlock(&file_private->syncobj_table_lock);
> idr_preload_end();
>
> - if (ret < 0) {
> - fput(syncobj->file);
> - return ret;
> - }
> - *handle = ret;
> - return 0;
> + if (ret > 0) {
> + *handle = ret;
> + ret = 0;
> + } else
> + drm_syncobj_put(syncobj);
> +
> + fput(file);
> + return ret;
> }
>
> int drm_syncobj_import_sync_file_fence(struct drm_file *file_private,
> diff --git a/include/drm/drm_syncobj.h b/include/drm/drm_syncobj.h
> index c00fee5..6d45aae 100644
> --- a/include/drm/drm_syncobj.h
> +++ b/include/drm/drm_syncobj.h
> @@ -60,11 +60,6 @@ struct drm_syncobj {
> * locks cb_list and write-locks fence.
> */
> spinlock_t lock;
> - /**
> - * @file:
> - * a file backing for this syncobj.
> - */
> - struct file *file;
> };
>
> typedef void (*drm_syncobj_func_t)(struct drm_syncobj *syncobj,
--
Jani Nikula, Intel Open Source Technology Center
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] drm/syncobj: Stop reusing the same struct file for all syncobj -> fd
2018-03-26 19:00 [PATCH] drm/syncobj: Stop reusing the same struct file for all syncobj -> fd Jason Ekstrand
@ 2018-03-27 7:29 ` Greg KH
2018-03-27 7:29 ` Greg KH
1 sibling, 0 replies; 8+ messages in thread
From: Greg KH @ 2018-03-27 7:29 UTC (permalink / raw)
To: Jason Ekstrand; +Cc: Dave Airlie, dri-devel, stable
On Mon, Mar 26, 2018 at 12:00:37PM -0700, Jason Ekstrand wrote:
> From: Chris Wilson <chris@chris-wilson.co.uk>
>
> The vk cts test:
> dEQP-VK.api.external.semaphore.opaque_fd.export_multiple_times_temporary
>
> triggers a lot of
> VFS: Close: file count is 0
>
> Dave pointed out that clearing the syncobj->file from
> drm_syncobj_file_release() was sufficient to silence the test, but that
> opens a can of worm since we assumed that the syncobj->file was never
> unset. Stop trying to reuse the same struct file for every fd pointing
> to the drm_syncobj, and allocate one file for each fd instead.
>
> v2: Fixup return handling of drm_syncobj_fd_to_handle
> v2.1: [airlied: fix possible syncobj ref race]
> v2.2: [jekstrand: back-port to 4.14]
>
> Reported-by: Dave Airlie <airlied@redhat.com>
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Tested-by: Dave Airlie <airlied@redhat.com>
> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> Signed-off-by: Dave Airlie <airlied@redhat.com>
> Signed-off-by: Jason Ekstrand <jason@jlekstrand.net>
> Tested-by: Clayton Craft <clayton.a.craft@intel.com>
> ---
>
> The back-port from 4.15 to 4.14 was non-trivial. It'd be good if Chris and
> maybe Daniel could do a quick re-review.
Now queued up, thanks.
greg k-h
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] drm/syncobj: Stop reusing the same struct file for all syncobj -> fd
@ 2018-03-27 7:29 ` Greg KH
0 siblings, 0 replies; 8+ messages in thread
From: Greg KH @ 2018-03-27 7:29 UTC (permalink / raw)
To: Jason Ekstrand; +Cc: stable, dri-devel, Chris Wilson, Dave Airlie
On Mon, Mar 26, 2018 at 12:00:37PM -0700, Jason Ekstrand wrote:
> From: Chris Wilson <chris@chris-wilson.co.uk>
>
> The vk cts test:
> dEQP-VK.api.external.semaphore.opaque_fd.export_multiple_times_temporary
>
> triggers a lot of
> VFS: Close: file count is 0
>
> Dave pointed out that clearing the syncobj->file from
> drm_syncobj_file_release() was sufficient to silence the test, but that
> opens a can of worm since we assumed that the syncobj->file was never
> unset. Stop trying to reuse the same struct file for every fd pointing
> to the drm_syncobj, and allocate one file for each fd instead.
>
> v2: Fixup return handling of drm_syncobj_fd_to_handle
> v2.1: [airlied: fix possible syncobj ref race]
> v2.2: [jekstrand: back-port to 4.14]
>
> Reported-by: Dave Airlie <airlied@redhat.com>
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Tested-by: Dave Airlie <airlied@redhat.com>
> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> Signed-off-by: Dave Airlie <airlied@redhat.com>
> Signed-off-by: Jason Ekstrand <jason@jlekstrand.net>
> Tested-by: Clayton Craft <clayton.a.craft@intel.com>
> ---
>
> The back-port from 4.15 to 4.14 was non-trivial. It'd be good if Chris and
> maybe Daniel could do a quick re-review.
Now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH] drm/syncobj: reset file ptr to NULL when released.
@ 2017-12-19 11:30 Dave Airlie
2017-12-19 12:07 ` [PATCH] drm/syncobj: Stop reusing the same struct file for all syncobj -> fd Chris Wilson
0 siblings, 1 reply; 8+ messages in thread
From: Dave Airlie @ 2017-12-19 11:30 UTC (permalink / raw)
To: dri-devel
From: Dave Airlie <airlied@redhat.com>
The vk cts test:
dEQP-VK.api.external.semaphore.opaque_fd.export_multiple_times_temporary
triggers a lot of
VFS: Close: file count is 0
This patch fixes it, but I'm guessing it's racy and someone will
smell rcu, but I just wanted to send out the proof of fixing it
so I remember.
Signed-off-by: Dave Airlie <airlied@redhat.com>
---
drivers/gpu/drm/drm_syncobj.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index f776fc1cc543..ffa5bbd75852 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -361,6 +361,7 @@ static int drm_syncobj_file_release(struct inode *inode, struct file *file)
{
struct drm_syncobj *syncobj = file->private_data;
+ syncobj->file = NULL;
drm_syncobj_put(syncobj);
return 0;
}
--
2.14.3
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH] drm/syncobj: Stop reusing the same struct file for all syncobj -> fd
2017-12-19 11:30 [PATCH] drm/syncobj: reset file ptr to NULL when released Dave Airlie
@ 2017-12-19 12:07 ` Chris Wilson
2017-12-19 12:28 ` Daniel Vetter
2017-12-21 2:42 ` Dave Airlie
0 siblings, 2 replies; 8+ messages in thread
From: Chris Wilson @ 2017-12-19 12:07 UTC (permalink / raw)
To: dri-devel; +Cc: Dave Airlie, intel-gfx
The vk cts test:
dEQP-VK.api.external.semaphore.opaque_fd.export_multiple_times_temporary
triggers a lot of
VFS: Close: file count is 0
Dave pointed out that clearing the syncobj->file from
drm_syncobj_file_release() was sufficient to silence the test, but that
opens a can of worm since we assumed that the syncobj->file was never
unset. Stop trying to reuse the same struct file for every fd pointing
to the drm_syncobj, and allocate one file for each fd instead.
Reported-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Dave Airlie <airlied@redhat.com>
---
drivers/gpu/drm/drm_syncobj.c | 74 +++++++++++++++----------------------------
include/drm/drm_syncobj.h | 4 ---
2 files changed, 26 insertions(+), 52 deletions(-)
diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index 131695915acd..0cca2e792719 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -399,23 +399,6 @@ static const struct file_operations drm_syncobj_file_fops = {
.release = drm_syncobj_file_release,
};
-static int drm_syncobj_alloc_file(struct drm_syncobj *syncobj)
-{
- struct file *file = anon_inode_getfile("syncobj_file",
- &drm_syncobj_file_fops,
- syncobj, 0);
- if (IS_ERR(file))
- return PTR_ERR(file);
-
- drm_syncobj_get(syncobj);
- if (cmpxchg(&syncobj->file, NULL, file)) {
- /* lost the race */
- fput(file);
- }
-
- return 0;
-}
-
/**
* drm_syncobj_get_fd - get a file descriptor from a syncobj
* @syncobj: Sync object to export
@@ -427,21 +410,24 @@ static int drm_syncobj_alloc_file(struct drm_syncobj *syncobj)
*/
int drm_syncobj_get_fd(struct drm_syncobj *syncobj, int *p_fd)
{
- int ret;
+ struct file *file;
int fd;
fd = get_unused_fd_flags(O_CLOEXEC);
if (fd < 0)
return fd;
- if (!syncobj->file) {
- ret = drm_syncobj_alloc_file(syncobj);
- if (ret) {
- put_unused_fd(fd);
- return ret;
- }
+ file = anon_inode_getfile("syncobj_file",
+ &drm_syncobj_file_fops,
+ syncobj, 0);
+ if (IS_ERR(file)) {
+ put_unused_fd(fd);
+ return PTR_ERR(file);
}
- fd_install(fd, syncobj->file);
+
+ drm_syncobj_get(syncobj);
+ fd_install(fd, file);
+
*p_fd = fd;
return 0;
}
@@ -461,31 +447,24 @@ static int drm_syncobj_handle_to_fd(struct drm_file *file_private,
return ret;
}
-static struct drm_syncobj *drm_syncobj_fdget(int fd)
-{
- struct file *file = fget(fd);
-
- if (!file)
- return NULL;
- if (file->f_op != &drm_syncobj_file_fops)
- goto err;
-
- return file->private_data;
-err:
- fput(file);
- return NULL;
-};
-
static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
int fd, u32 *handle)
{
- struct drm_syncobj *syncobj = drm_syncobj_fdget(fd);
+ struct drm_syncobj *syncobj;
+ struct file *file;
int ret;
- if (!syncobj)
+ file = fget(fd);
+ if (!file)
return -EINVAL;
+ if (file->f_op != &drm_syncobj_file_fops) {
+ fput(file);
+ return -EINVAL;
+ }
+
/* take a reference to put in the idr */
+ syncobj = file->private_data;
drm_syncobj_get(syncobj);
idr_preload(GFP_KERNEL);
@@ -494,12 +473,11 @@ static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
spin_unlock(&file_private->syncobj_table_lock);
idr_preload_end();
- if (ret < 0) {
- fput(syncobj->file);
- return ret;
- }
- *handle = ret;
- return 0;
+ if (ret > 0)
+ *handle = ret;
+
+ fput(file);
+ return ret;
}
static int drm_syncobj_import_sync_file_fence(struct drm_file *file_private,
diff --git a/include/drm/drm_syncobj.h b/include/drm/drm_syncobj.h
index 3980602472c0..ca5bf7d12d0b 100644
--- a/include/drm/drm_syncobj.h
+++ b/include/drm/drm_syncobj.h
@@ -56,10 +56,6 @@ struct drm_syncobj {
* @lock: Protects &cb_list and write-locks &fence.
*/
spinlock_t lock;
- /**
- * @file: A file backing for this syncobj.
- */
- struct file *file;
};
typedef void (*drm_syncobj_func_t)(struct drm_syncobj *syncobj,
--
2.15.1
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH] drm/syncobj: Stop reusing the same struct file for all syncobj -> fd
2017-12-19 12:07 ` [PATCH] drm/syncobj: Stop reusing the same struct file for all syncobj -> fd Chris Wilson
@ 2017-12-19 12:28 ` Daniel Vetter
2017-12-21 2:42 ` Dave Airlie
1 sibling, 0 replies; 8+ messages in thread
From: Daniel Vetter @ 2017-12-19 12:28 UTC (permalink / raw)
To: Chris Wilson; +Cc: Dave Airlie, intel-gfx, dri-devel
On Tue, Dec 19, 2017 at 12:07:00PM +0000, Chris Wilson wrote:
> The vk cts test:
> dEQP-VK.api.external.semaphore.opaque_fd.export_multiple_times_temporary
>
> triggers a lot of
> VFS: Close: file count is 0
>
> Dave pointed out that clearing the syncobj->file from
> drm_syncobj_file_release() was sufficient to silence the test, but that
> opens a can of worm since we assumed that the syncobj->file was never
> unset. Stop trying to reuse the same struct file for every fd pointing
> to the drm_syncobj, and allocate one file for each fd instead.
It's worse: syncobj->file points to a refcounted thing, and we never did
grab a reference for it. This is a classic use-after-free thing :-)
> Reported-by: Dave Airlie <airlied@redhat.com>
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Dave Airlie <airlied@redhat.com>
Assuming it doesn't break the vk testsuite:
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Also an igt for this would be nice:
1. create syncobj
2. export to fd
3. close fd, note that now syncobj->file points to a freed struct file
4. reexport -> BOOM
Cheers, Daniel
> ---
> drivers/gpu/drm/drm_syncobj.c | 74 +++++++++++++++----------------------------
> include/drm/drm_syncobj.h | 4 ---
> 2 files changed, 26 insertions(+), 52 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
> index 131695915acd..0cca2e792719 100644
> --- a/drivers/gpu/drm/drm_syncobj.c
> +++ b/drivers/gpu/drm/drm_syncobj.c
> @@ -399,23 +399,6 @@ static const struct file_operations drm_syncobj_file_fops = {
> .release = drm_syncobj_file_release,
> };
>
> -static int drm_syncobj_alloc_file(struct drm_syncobj *syncobj)
> -{
> - struct file *file = anon_inode_getfile("syncobj_file",
> - &drm_syncobj_file_fops,
> - syncobj, 0);
> - if (IS_ERR(file))
> - return PTR_ERR(file);
> -
> - drm_syncobj_get(syncobj);
> - if (cmpxchg(&syncobj->file, NULL, file)) {
> - /* lost the race */
> - fput(file);
> - }
> -
> - return 0;
> -}
> -
> /**
> * drm_syncobj_get_fd - get a file descriptor from a syncobj
> * @syncobj: Sync object to export
> @@ -427,21 +410,24 @@ static int drm_syncobj_alloc_file(struct drm_syncobj *syncobj)
> */
> int drm_syncobj_get_fd(struct drm_syncobj *syncobj, int *p_fd)
> {
> - int ret;
> + struct file *file;
> int fd;
>
> fd = get_unused_fd_flags(O_CLOEXEC);
> if (fd < 0)
> return fd;
>
> - if (!syncobj->file) {
> - ret = drm_syncobj_alloc_file(syncobj);
> - if (ret) {
> - put_unused_fd(fd);
> - return ret;
> - }
> + file = anon_inode_getfile("syncobj_file",
> + &drm_syncobj_file_fops,
> + syncobj, 0);
> + if (IS_ERR(file)) {
> + put_unused_fd(fd);
> + return PTR_ERR(file);
> }
> - fd_install(fd, syncobj->file);
> +
> + drm_syncobj_get(syncobj);
> + fd_install(fd, file);
> +
> *p_fd = fd;
> return 0;
> }
> @@ -461,31 +447,24 @@ static int drm_syncobj_handle_to_fd(struct drm_file *file_private,
> return ret;
> }
>
> -static struct drm_syncobj *drm_syncobj_fdget(int fd)
> -{
> - struct file *file = fget(fd);
> -
> - if (!file)
> - return NULL;
> - if (file->f_op != &drm_syncobj_file_fops)
> - goto err;
> -
> - return file->private_data;
> -err:
> - fput(file);
> - return NULL;
> -};
> -
> static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
> int fd, u32 *handle)
> {
> - struct drm_syncobj *syncobj = drm_syncobj_fdget(fd);
> + struct drm_syncobj *syncobj;
> + struct file *file;
> int ret;
>
> - if (!syncobj)
> + file = fget(fd);
> + if (!file)
> return -EINVAL;
>
> + if (file->f_op != &drm_syncobj_file_fops) {
> + fput(file);
> + return -EINVAL;
> + }
> +
> /* take a reference to put in the idr */
> + syncobj = file->private_data;
> drm_syncobj_get(syncobj);
>
> idr_preload(GFP_KERNEL);
> @@ -494,12 +473,11 @@ static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
> spin_unlock(&file_private->syncobj_table_lock);
> idr_preload_end();
>
> - if (ret < 0) {
> - fput(syncobj->file);
> - return ret;
> - }
> - *handle = ret;
> - return 0;
> + if (ret > 0)
> + *handle = ret;
> +
> + fput(file);
> + return ret;
> }
>
> static int drm_syncobj_import_sync_file_fence(struct drm_file *file_private,
> diff --git a/include/drm/drm_syncobj.h b/include/drm/drm_syncobj.h
> index 3980602472c0..ca5bf7d12d0b 100644
> --- a/include/drm/drm_syncobj.h
> +++ b/include/drm/drm_syncobj.h
> @@ -56,10 +56,6 @@ struct drm_syncobj {
> * @lock: Protects &cb_list and write-locks &fence.
> */
> spinlock_t lock;
> - /**
> - * @file: A file backing for this syncobj.
> - */
> - struct file *file;
> };
>
> typedef void (*drm_syncobj_func_t)(struct drm_syncobj *syncobj,
> --
> 2.15.1
>
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/intel-gfx
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] drm/syncobj: Stop reusing the same struct file for all syncobj -> fd
2017-12-19 12:07 ` [PATCH] drm/syncobj: Stop reusing the same struct file for all syncobj -> fd Chris Wilson
2017-12-19 12:28 ` Daniel Vetter
@ 2017-12-21 2:42 ` Dave Airlie
1 sibling, 0 replies; 8+ messages in thread
From: Dave Airlie @ 2017-12-21 2:42 UTC (permalink / raw)
To: Chris Wilson; +Cc: Dave Airlie, intel-gfx, dri-devel
> @@ -494,12 +473,11 @@ static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
> spin_unlock(&file_private->syncobj_table_lock);
> idr_preload_end();
>
> - if (ret < 0) {
> - fput(syncobj->file);
> - return ret;
> - }
> - *handle = ret;
> - return 0;
> + if (ret > 0)
> + *handle = ret;
> +
> + fput(file);
> + return ret;
> }
This chunk breaks stuff, since it now returns the handle in ret if >
0, whereas before
it returned 0.
Otherwise the vulkan tests all pass on it.
Dave.
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2018-03-27 7:29 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-03-26 19:00 [PATCH] drm/syncobj: Stop reusing the same struct file for all syncobj -> fd Jason Ekstrand
2018-03-27 6:37 ` Jani Nikula
2018-03-27 6:37 ` Jani Nikula
2018-03-27 7:29 ` Greg KH
2018-03-27 7:29 ` Greg KH
-- strict thread matches above, loose matches on Subject: below --
2017-12-19 11:30 [PATCH] drm/syncobj: reset file ptr to NULL when released Dave Airlie
2017-12-19 12:07 ` [PATCH] drm/syncobj: Stop reusing the same struct file for all syncobj -> fd Chris Wilson
2017-12-19 12:28 ` Daniel Vetter
2017-12-21 2:42 ` Dave Airlie
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.