From patchwork Wed Apr 12 02:55:30 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeffy Chen X-Patchwork-Id: 9678565 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id EE1BA60385 for ; Thu, 13 Apr 2017 01:29:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E090C2863B for ; Thu, 13 Apr 2017 01:29:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D522B28649; Thu, 13 Apr 2017 01:29:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 9277E2863B for ; Thu, 13 Apr 2017 01:29:01 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 85B466E7BA; Thu, 13 Apr 2017 01:28:54 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from regular1.263xmail.com (regular1.263xmail.com [211.150.99.131]) by gabe.freedesktop.org (Postfix) with ESMTPS id 5976B6E45D for ; Wed, 12 Apr 2017 02:56:44 +0000 (UTC) Received: from jeffy.chen?rock-chips.com (unknown [192.168.165.141]) by regular1.263xmail.com (Postfix) with ESMTP id 9F6D76364; Wed, 12 Apr 2017 10:56:38 +0800 (CST) X-263anti-spam: KSV:0; X-MAIL-GRAY: 0 X-MAIL-DELIVERY: 1 X-KSVirus-check: 0 X-ABS-CHECKED: 4 Received: from smtp.263.net (sg-smtp01.263.net [54.255.195.220]) by smtp.263.net (Postfix) with ESMTP id 15446433; Wed, 12 Apr 2017 10:56:34 +0800 (CST) Received: from localhost (localhost.localdomain [127.0.0.1]) by smtp.263.net (Postfix) with ESMTP id 53924DF313; Wed, 12 Apr 2017 10:56:33 +0800 (CST) X-RL-SENDER: jeffy.chen@rock-chips.com X-FST-TO: linux-kernel@vger.kernel.org X-SENDER-IP: 103.29.142.67 X-LOGIN-NAME: jeffy.chen@rock-chips.com X-UNIQUE-TAG: <2ac3dd32b379b3b2b8fba0585849840c> X-ATTACHMENT-NUM: 0 X-SENDER: cjf@rock-chips.com X-DNS-TYPE: 0 Received: from localhost (unknown [103.29.142.67]) by smtp.263.net (Postfix) whith ESMTP id 22671JZLBDZ; Wed, 12 Apr 2017 10:56:34 +0800 (CST) From: Jeffy Chen To: linux-kernel@vger.kernel.org Subject: [PATCH v8 2/2] drm: Prevent release fb after cleanup drm_mode_config Date: Wed, 12 Apr 2017 10:55:30 +0800 Message-Id: <1491965730-31393-3-git-send-email-jeffy.chen@rock-chips.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1491965730-31393-1-git-send-email-jeffy.chen@rock-chips.com> References: <1491965730-31393-1-git-send-email-jeffy.chen@rock-chips.com> X-Mailman-Approved-At: Thu, 13 Apr 2017 01:28:52 +0000 Cc: Jeffy Chen , briannorris@chromium.org, dianders@chromium.org, tfiga@chromium.org, dri-devel@lists.freedesktop.org, Daniel Vetter , zyw@rock-chips.com, marcheu@chromium.org, hshi@chromium.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP We are freeing all framebuffers in drm_mode_config_cleanup without sync the drm_file's fbs list. So if someone try to unbind drm before release drm dev fd, the fbs list would remain some invalid fb references. And that would cause crash later in drm_fb_release. Add a sanity check to prevent that. Signed-off-by: Jeffy Chen --- Changes in v8: None Changes in v7: Update commit message. Changes in v6: None Changes in v5: None Changes in v2: None drivers/gpu/drm/drm_framebuffer.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c index e8f9c13..03c1632 100644 --- a/drivers/gpu/drm/drm_framebuffer.c +++ b/drivers/gpu/drm/drm_framebuffer.c @@ -583,6 +583,11 @@ void drm_fb_release(struct drm_file *priv) { struct drm_framebuffer *fb, *tfb; struct drm_mode_rmfb_work arg; + struct drm_minor *minor = priv->minor; + struct drm_device *dev = minor->dev; + + if (WARN_ON(!dev->mode_config.num_fb && !list_empty(&priv->fbs))) + return; INIT_LIST_HEAD(&arg.fbs);