Re: [PATCH 06/13] drm: add minor-lookup/release helpers

[Thierry Reding <thierry.reding@gmail.com>]

[-- Attachment #1.1: Type: text/plain, Size: 1473 bytes --]

On Wed, Jan 29, 2014 at 03:01:53PM +0100, David Herrmann wrote:
[...]
> diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
> index c51333e..d3232b6 100644
> --- a/drivers/gpu/drm/drm_stub.c
> +++ b/drivers/gpu/drm/drm_stub.c
> @@ -356,6 +356,45 @@ static void drm_unplug_minor(struct drm_minor *minor)
>  }
>  
>  /**
> + * drm_minor_acquire - Acquire a DRM minor
> + * @minor_id: Minor ID of the DRM-minor
> + *
> + * Looks up the given minor-ID and returns the respective DRM-minor object. The
> + * refence-count of the underlying device is increased so you must release this
> + * object with drm_minor_release().
> + *
> + * As long as you hold this minor, it is guaranteed that the object and the
> + * minor->dev pointer will stay valid! However, the device may get unplugged and
> + * unregistered while you hold the minor.
> + *
> + * Returns:
> + * Pointer to minor-object with increased device-refcount, or PTR_ERR on
> + * failure.
> + */
> +struct drm_minor *drm_minor_acquire(unsigned int minor_id)
> +{
> +	struct drm_minor *minor;
> +
> +	minor = idr_find(&drm_minors_idr, minor_id);
> +	if (!minor)
> +		return ERR_PTR(-ENODEV);
> +
> +	drm_dev_ref(minor->dev);

Is it possible that somebody would drop the last reference on the device
right between the idr_find() call and drm_dev_ref()? In which case both
the device and the minor will have become invalid when drm_dev_ref() is
called.

Thierry

[-- Attachment #1.2: Type: application/pgp-signature, Size: 836 bytes --]

[-- Attachment #2: Type: text/plain, Size: 159 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel