[PATCH] dma-buf/sync_file: Always increment refcount when merging fences.

[PATCH] dma-buf/sync_file: Always increment refcount when merging fences.

[Rafael Antognolli]

The refcount of a fence should be increased whenever it is added to a merged
fence, since it will later be decreased when the merged fence is destroyed.
Failing to do so will cause the original fence to be freed if the merged fence
gets freed, but other places still referencing won't know about it.

This patch fixes a kernel panic that can be triggered by creating a fence that
is expired (or increasing the timeline until it expires), then creating a
merged fence out of it, and deleting the merged fence. This will make the
original expired fence's refcount go to zero.

Signed-off-by: Rafael Antognolli <rafael.antognolli@intel.com>
---

Sample code to trigger the mentioned kernel panic (might need to be executed a
couple times before it actually breaks everything):

static void test_sync_expired_merge(void)
{
       int iterations = 1 << 20;
       int timeline;
       int i;
       int fence_expired, fence_merged;

       timeline = sw_sync_timeline_create();

       sw_sync_timeline_inc(timeline, 100);
       fence_expired = sw_sync_fence_create(timeline, 1);
       fence_merged = sw_sync_merge(fence_expired, fence_expired);
       sw_sync_fence_destroy(fence_merged);

       for (i = 0; i < iterations; i++) {
               int fence = sw_sync_merge(fence_expired, fence_expired);

               igt_assert_f(sw_sync_wait(fence, -1) > 0,
                                    "Failure waiting on fence\n");
               sw_sync_fence_destroy(fence);
       }

       sw_sync_fence_destroy(fence_expired);
}

 drivers/dma-buf/sync_file.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
index 486d29c..6ce6b8f 100644
--- a/drivers/dma-buf/sync_file.c
+++ b/drivers/dma-buf/sync_file.c
@@ -178,11 +178,8 @@ static struct fence **get_fences(struct sync_file *sync_file, int *num_fences)
 static void add_fence(struct fence **fences, int *i, struct fence *fence)
 {
 	fences[*i] = fence;
-
-	if (!fence_is_signaled(fence)) {
-		fence_get(fence);
-		(*i)++;
-	}
+	fence_get(fence);
+	(*i)++;
 }
 
 /**
-- 
2.7.4

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

✗ Fi.CI.BAT: failure for dma-buf/sync_file: Always increment refcount when merging fences.

[Patchwork]

== Series Details ==

Series: dma-buf/sync_file: Always increment refcount when merging fences.
URL   : https://patchwork.freedesktop.org/series/12414/
State : failure

== Summary ==

Series 12414v1 dma-buf/sync_file: Always increment refcount when merging fences.
https://patchwork.freedesktop.org/api/1.0/series/12414/revisions/1/mbox/

Test drv_module_reload_basic:
                dmesg-warn -> SKIP       (fi-skl-6700k)
                pass       -> SKIP       (fi-skl-6260u)
Test kms_cursor_legacy:
        Subgroup basic-cursor-vs-flip-varying-size:
                fail       -> PASS       (fi-ilk-650)
Test kms_pipe_crc_basic:
        Subgroup hang-read-crc-pipe-c:
                skip       -> PASS       (fi-hsw-4770r)
        Subgroup suspend-read-crc-pipe-c:
                pass       -> INCOMPLETE (fi-hsw-4770k)

fi-bsw-n3050     total:254  pass:208  dwarn:0   dfail:0   fail:0   skip:46 
fi-hsw-4770k     total:218  pass:197  dwarn:0   dfail:0   fail:0   skip:20 
fi-hsw-4770r     total:254  pass:228  dwarn:0   dfail:0   fail:0   skip:26 
fi-ilk-650       total:254  pass:185  dwarn:0   dfail:0   fail:1   skip:68 
fi-ivb-3520m     total:254  pass:223  dwarn:0   dfail:0   fail:0   skip:31 
fi-ivb-3770      total:254  pass:211  dwarn:0   dfail:0   fail:0   skip:43 
fi-skl-6260u     total:254  pass:239  dwarn:0   dfail:0   fail:0   skip:15 
fi-skl-6700hq    total:254  pass:227  dwarn:0   dfail:0   fail:1   skip:26 
fi-skl-6700k     total:254  pass:225  dwarn:0   dfail:0   fail:0   skip:29 
fi-snb-2520m     total:254  pass:210  dwarn:0   dfail:0   fail:0   skip:44 
fi-snb-2600      total:254  pass:209  dwarn:0   dfail:0   fail:0   skip:45 

Results at /archive/results/CI_IGT_test/Patchwork_2523/

208290026552464713d3897ab5d649f4445d5513 drm-intel-nightly: 2016y-09m-13d-14h-45m-32s UTC integration manifest
6864e51 dma-buf/sync_file: Always increment refcount when merging fences.

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx