[patch] i915: take struct_mutex in i915_dma_cleanup()

[patch] i915: take struct_mutex in i915_dma_cleanup()

[Dan Carpenter]

intel_cleanup_ring_buffer() calls drm_gem_object_unreference() (as
opposed to drm_gem_object_unreference_unlocked()) so it needs to be
called with "struct_mutex" held.  If we don't hold the lock, it triggers
a BUG_ON(!mutex_is_locked(&dev->struct_mutex));

I also audited the other places that call intel_cleanup_ring_buffer()
and they all hold the lock so they're OK.

This was introduced in: 8187a2b70e3 "drm/i915: introduce
intel_ring_buffer structure (V2)" and it's a regression from v2.6.34.

Addresses: https://bugzilla.kernel.org/show_bug.cgi?id=16247

Signed-off-by: Dan Carpenter <error27@gmail.com>
Reported-by: Benny Halevy <bhalevy@panasas.com>
Tested-by: Benny Halevy <bhalevy@panasas.com>

diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 59a2bf8..3325af1 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -128,9 +128,11 @@ static int i915_dma_cleanup(struct drm_device * dev)
 	if (dev->irq_enabled)
 		drm_irq_uninstall(dev);
 
+	mutex_lock(&dev->struct_mutex);
 	intel_cleanup_ring_buffer(dev, &dev_priv->render_ring);
 	if (HAS_BSD(dev))
 		intel_cleanup_ring_buffer(dev, &dev_priv->bsd_ring);
+	mutex_unlock(&dev->struct_mutex);
 
 	/* Clear the HWS virtual address at teardown */
 	if (I915_NEED_GFX_HWS(dev))

Re: [patch] i915: take struct_mutex in i915_dma_cleanup()

[Jesse Barnes]

On Wed, 23 Jun 2010 13:19:55 +0200
Dan Carpenter <error27@gmail.com> wrote:

> intel_cleanup_ring_buffer() calls drm_gem_object_unreference() (as
> opposed to drm_gem_object_unreference_unlocked()) so it needs to be
> called with "struct_mutex" held.  If we don't hold the lock, it triggers
> a BUG_ON(!mutex_is_locked(&dev->struct_mutex));
> 
> I also audited the other places that call intel_cleanup_ring_buffer()
> and they all hold the lock so they're OK.
> 
> This was introduced in: 8187a2b70e3 "drm/i915: introduce
> intel_ring_buffer structure (V2)" and it's a regression from v2.6.34.
> 
> Addresses: https://bugzilla.kernel.org/show_bug.cgi?id=16247
> 
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> Reported-by: Benny Halevy <bhalevy@panasas.com>
> Tested-by: Benny Halevy <bhalevy@panasas.com>

Reminds me, Gordon can you add module unload testing to your set of
basic daily tests?  To unload you need to unbind the fbcon interface
first, my script is like this:

echo 0 > /sys/class/vtconsole/vtcon1/bind
rmmod i915
rmmod drm_kms_helper
rmmod drm
modprobe i915
echo 1 > /sys/class/vtconsole/vtcon1/bind

If unload and re-load doesn't work please file a bug and see if you can
bisect it.

Thanks,
-- 
Jesse Barnes, Intel Open Source Technology Center

Re: [patch] i915: take struct_mutex in i915_dma_cleanup()

[Chris Wilson]

On Wed, 23 Jun 2010 08:47:18 -0700, Jesse Barnes <jbarnes@virtuousgeek.org> wrote:
> Reminds me, Gordon can you add module unload testing to your set of
> basic daily tests?  To unload you need to unbind the fbcon interface
> first, my script is like this:
> 
> echo 0 > /sys/class/vtconsole/vtcon1/bind
> rmmod i915
> rmmod drm_kms_helper
> rmmod drm
> modprobe i915
> echo 1 > /sys/class/vtconsole/vtcon1/bind

To which we could even add a kmemleak check.
After rmmod drm and before reloading i915:
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleak > `hostname`-leaks.txt

If the output is not empty, file a bug. [Of course this means having to
compile kmemleak into the kernel. The DEBUG_KMEMLEAK option is found under
Kernel Hacking.] And since each generation has slightly different
initialization stanzas, we need to repeat the test on all platforms.
-- 
Chris Wilson, Intel Open Source Technology Centre

Re: [patch] i915: take struct_mutex in i915_dma_cleanup()

[Eric Anholt]

[-- Attachment #1: Type: text/plain, Size: 863 bytes --]

On Wed, 23 Jun 2010 13:19:55 +0200, Dan Carpenter <error27@gmail.com> wrote:
> intel_cleanup_ring_buffer() calls drm_gem_object_unreference() (as
> opposed to drm_gem_object_unreference_unlocked()) so it needs to be
> called with "struct_mutex" held.  If we don't hold the lock, it triggers
> a BUG_ON(!mutex_is_locked(&dev->struct_mutex));
> 
> I also audited the other places that call intel_cleanup_ring_buffer()
> and they all hold the lock so they're OK.
> 
> This was introduced in: 8187a2b70e3 "drm/i915: introduce
> intel_ring_buffer structure (V2)" and it's a regression from v2.6.34.
> 
> Addresses: https://bugzilla.kernel.org/show_bug.cgi?id=16247
> 
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> Reported-by: Benny Halevy <bhalevy@panasas.com>
> Tested-by: Benny Halevy <bhalevy@panasas.com>

Applied to for-linus.  Thanks!

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]