Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753744AbdDFI0U (ORCPT ); Thu, 6 Apr 2017 04:26:20 -0400 Received: from mail-wr0-f196.google.com ([209.85.128.196]:36289 "EHLO mail-wr0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752080AbdDFI0Q (ORCPT ); Thu, 6 Apr 2017 04:26:16 -0400 Date: Thu, 6 Apr 2017 10:26:12 +0200 From: Daniel Vetter To: Sean Paul Cc: Jeffy Chen , dianders@chromium.org, briannorris@chromium.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, tfiga@chromium.org, linux-rockchip@lists.infradead.org, zyw@rock-chips.com, linux-arm-kernel@lists.infradead.org Subject: Re: [PATCH v3 8/9] drm/rockchip: gem: Don't alloc/free gem buf when dev_private is invalid Message-ID: <20170406082612.qmwyfjr5uwcp3arr@phenom.ffwll.local> Mail-Followup-To: Sean Paul , Jeffy Chen , dianders@chromium.org, briannorris@chromium.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, tfiga@chromium.org, linux-rockchip@lists.infradead.org, zyw@rock-chips.com, linux-arm-kernel@lists.infradead.org References: <1491380967-28570-1-git-send-email-jeffy.chen@rock-chips.com> <1491380967-28570-9-git-send-email-jeffy.chen@rock-chips.com> <20170405162839.k6q4b3tpt6t2s3zm@art_vandelay> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170405162839.k6q4b3tpt6t2s3zm@art_vandelay> X-Operating-System: Linux phenom 4.9.0-2-amd64 User-Agent: NeoMutt/20170306 (1.8.0) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2204 Lines: 72 On Wed, Apr 05, 2017 at 12:28:40PM -0400, Sean Paul wrote: > On Wed, Apr 05, 2017 at 04:29:26PM +0800, Jeffy Chen wrote: > > After unbinding drm, the userspace may still has a chance to access > > gem buf. > > > > Add a sanity check for a NULL dev_private to prevent that from > > happening. > > I still don't understand how this is happening. You're saying that these hooks > can be called after rockchip_drm_unbind() has finished? Yeah this is supposed to be impossible. If it isn't, we need to debug and fix this properly. This smells like pretty bad duct-tape ... -Daniel > > Sean > > > > > Signed-off-by: Jeffy Chen > > --- > > > > Changes in v3: > > Address Daniel Vetter 's comments. > > Update commit message. > > > > Changes in v2: None > > > > drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 8 ++++++++ > > 1 file changed, 8 insertions(+) > > > > diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > > index df9e570..205a3dc 100644 > > --- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > > +++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c > > @@ -184,6 +184,9 @@ static int rockchip_gem_alloc_buf(struct rockchip_gem_object *rk_obj, > > struct drm_device *drm = obj->dev; > > struct rockchip_drm_private *private = drm->dev_private; > > > > + if (!private) > > + return -ENODEV; > > + > > if (private->domain) > > return rockchip_gem_alloc_iommu(rk_obj, alloc_kmap); > > else > > @@ -208,6 +211,11 @@ static void rockchip_gem_free_dma(struct rockchip_gem_object *rk_obj) > > > > static void rockchip_gem_free_buf(struct rockchip_gem_object *rk_obj) > > { > > + struct drm_device *drm = rk_obj->base.dev; > > + > > + if (!drm->dev_private) > > + return; > > + > > if (rk_obj->pages) > > rockchip_gem_free_iommu(rk_obj); > > else > > -- > > 2.1.4 > > > > -- > Sean Paul, Software Engineer, Google / Chromium OS > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > https://lists.freedesktop.org/mailman/listinfo/dri-devel -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch