From patchwork Tue Sep 13 23:19:48 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rafael Antognolli X-Patchwork-Id: 9330117 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 163386077F for ; Tue, 13 Sep 2016 23:20:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 04CA528EB9 for ; Tue, 13 Sep 2016 23:20:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id EDACB297DA; Tue, 13 Sep 2016 23:20:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id A408528EB9 for ; Tue, 13 Sep 2016 23:20:29 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 962F56E0C7; Tue, 13 Sep 2016 23:20:22 +0000 (UTC) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by gabe.freedesktop.org (Postfix) with ESMTPS id 6E6FA6E0C7 for ; Tue, 13 Sep 2016 23:20:20 +0000 (UTC) Received: from orsmga002.jf.intel.com ([10.7.209.21]) by fmsmga103.fm.intel.com with ESMTP; 13 Sep 2016 16:19:56 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos; i="5.30,331,1470726000"; d="scan'208"; a="1049877004" Received: from nadine3.jf.intel.com ([10.7.197.56]) by orsmga002.jf.intel.com with ESMTP; 13 Sep 2016 16:19:57 -0700 From: Rafael Antognolli To: intel-gfx@lists.freedesktop.org Date: Tue, 13 Sep 2016 16:19:48 -0700 Message-Id: <1473808788-5949-1-git-send-email-rafael.antognolli@intel.com> X-Mailer: git-send-email 2.7.4 Cc: gustavo.padovan@collabora.co.uk Subject: [Intel-gfx] [PATCH] dma-buf/sync_file: Always increment refcount when merging fences. X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" X-Virus-Scanned: ClamAV using ClamSMTP The refcount of a fence should be increased whenever it is added to a merged fence, since it will later be decreased when the merged fence is destroyed. Failing to do so will cause the original fence to be freed if the merged fence gets freed, but other places still referencing won't know about it. This patch fixes a kernel panic that can be triggered by creating a fence that is expired (or increasing the timeline until it expires), then creating a merged fence out of it, and deleting the merged fence. This will make the original expired fence's refcount go to zero. Signed-off-by: Rafael Antognolli --- Sample code to trigger the mentioned kernel panic (might need to be executed a couple times before it actually breaks everything): static void test_sync_expired_merge(void) { int iterations = 1 << 20; int timeline; int i; int fence_expired, fence_merged; timeline = sw_sync_timeline_create(); sw_sync_timeline_inc(timeline, 100); fence_expired = sw_sync_fence_create(timeline, 1); fence_merged = sw_sync_merge(fence_expired, fence_expired); sw_sync_fence_destroy(fence_merged); for (i = 0; i < iterations; i++) { int fence = sw_sync_merge(fence_expired, fence_expired); igt_assert_f(sw_sync_wait(fence, -1) > 0, "Failure waiting on fence\n"); sw_sync_fence_destroy(fence); } sw_sync_fence_destroy(fence_expired); } drivers/dma-buf/sync_file.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c index 486d29c..6ce6b8f 100644 --- a/drivers/dma-buf/sync_file.c +++ b/drivers/dma-buf/sync_file.c @@ -178,11 +178,8 @@ static struct fence **get_fences(struct sync_file *sync_file, int *num_fences) static void add_fence(struct fence **fences, int *i, struct fence *fence) { fences[*i] = fence; - - if (!fence_is_signaled(fence)) { - fence_get(fence); - (*i)++; - } + fence_get(fence); + (*i)++; } /**