Commit f175b745 authored by Francisco Jerez's avatar Francisco Jerez Committed by Ben Skeggs

drm/nouveau: Fix race condition in channel refcount handling.

nouveau_channel_put() can be executed after the 'refcount == 0' check
in nouveau_channel_get() and before the channel reference count is
incremented. In that case CPU0 will take the context down while CPU1
thinks it owns the channel and 'refcount == 1'.
Signed-off-by: default avatarFrancisco Jerez <currojerez@riseup.net>
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
parent 3945e475
...@@ -247,17 +247,16 @@ nouveau_channel_get(struct drm_device *dev, struct drm_file *file_priv, int id) ...@@ -247,17 +247,16 @@ nouveau_channel_get(struct drm_device *dev, struct drm_file *file_priv, int id)
spin_lock_irqsave(&dev_priv->channels.lock, flags); spin_lock_irqsave(&dev_priv->channels.lock, flags);
chan = dev_priv->channels.ptr[id]; chan = dev_priv->channels.ptr[id];
if (unlikely(!chan || atomic_read(&chan->refcount) == 0)) { if (unlikely(!chan || (file_priv && chan->file_priv != file_priv))) {
spin_unlock_irqrestore(&dev_priv->channels.lock, flags); spin_unlock_irqrestore(&dev_priv->channels.lock, flags);
return ERR_PTR(-EINVAL); return ERR_PTR(-EINVAL);
} }
if (unlikely(file_priv && chan->file_priv != file_priv)) { if (unlikely(!atomic_inc_not_zero(&chan->refcount))) {
spin_unlock_irqrestore(&dev_priv->channels.lock, flags); spin_unlock_irqrestore(&dev_priv->channels.lock, flags);
return ERR_PTR(-EINVAL); return ERR_PTR(-EINVAL);
} }
atomic_inc(&chan->refcount);
spin_unlock_irqrestore(&dev_priv->channels.lock, flags); spin_unlock_irqrestore(&dev_priv->channels.lock, flags);
mutex_lock(&chan->mutex); mutex_lock(&chan->mutex);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment