Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [Linaro-mm-sig] [PATCH] dma-buf/poll: Get a file reference for
 outstanding fence callbacks
To:     =?UTF-8?Q?Michel_D=c3=a4nzer?= <michel@daenzer.net>,
        =?UTF-8?Q?Christian_K=c3=b6nig?= <ckoenig.leichtzumerken@gmail.com>
Cc:     linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org,
        dri-devel@lists.freedesktop.org, linux-media@vger.kernel.org
References: <20210723075857.4065-1-michel@daenzer.net>
 <f5f37693-bfe2-e52f-172b-00f4aa94dbd9@amd.com>
 <4cf94f59-f953-f5d7-9901-cfe5fd63bfbc@daenzer.net>
 <884050b3-5e7d-c00b-5467-290cfc57e0ea@gmail.com>
 <20cfea36-a8cc-7bd1-9604-57efdf4710e2@daenzer.net>
From:   =?UTF-8?Q?Christian_K=c3=b6nig?= <christian.koenig@amd.com>
Message-ID: <c0265dc9-15c4-e838-f183-3e9b82a6ff50@amd.com>
Date:   Thu, 4 Nov 2021 09:20:40 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.13.0
In-Reply-To: <20cfea36-a8cc-7bd1-9604-57efdf4710e2@daenzer.net>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?MVBPVFFXaHNNUXhtczlHcllBcHRkMGFFODVadlYrOWFqRkQ1cTNoN3FMcklS?=
 =?utf-8?B?YitGU1ZJbVVJM0hXNzAwL2hYOHZXSDFzWnRlM1Q0VHA2TkUrRFV4Y0JnUDlH?=
 =?utf-8?B?U1hUL2JodmNmUGZralY2cWxnR3pyTHpSd0hqa2RMM0hQV0M0dnF5RE5BV0d1?=
 =?utf-8?B?ZktmcjN5QjR2UEE4RldoWXlBQzFtMVpJZU9zdGI3SlRBeTZIOWhTTUFWc09n?=
 =?utf-8?B?ZHNFSW16MFBZQjdnMEY4Y2w4QmJyL051MHlnaFhKV3FvbFRNb2ZVb0J1K2w2?=
 =?utf-8?B?dC9SdmV3Y2d6ZWJzMVlIaW5SbDEvUy9rVDNOWDJuNThMdTdZd0tsOC9xSDhR?=
 =?utf-8?B?NVNvYmIycS9vVTlVb2crWmFQNEI3dmF2bzFTSHNDSEZ5MWJhOWR6aUNRekFi?=
 =?utf-8?B?OWxDNlA4ajZ4cmxwczNNRERlVWhrWUxHYVc0UHByRUc0WWJ2MEUvNXV1NTlt?=
 =?utf-8?B?a3ZsQW03aDhMamZjYVlHUnUzVjlnNkxMcTY1OUVFS09NRVBVU1NheDhWOHFL?=
 =?utf-8?B?dGZZa2xua3I0SGlDbzVWOFQxa0xtd05ydUxXY1A0ZmpLd1A4dWlnWUlVTDF2?=
 =?utf-8?B?aWozK3lPTDVZcUgxNE8rVC83SzhWSjBIeUtPZWtqU3c1aWZuL2JqeDBvd0tP?=
 =?utf-8?B?ZmcyaDBDQkd2WEx0aEg5SVJXZERlM3hUYUNQOXJ5OWVVUEx1b2Y1eVZGZWpj?=
 =?utf-8?B?d3FqaC9TV3FQYUlyVjBUWWw2UGoyNjhHaVhaelpJU2Q2WkYyYUtKWnNRdWtJ?=
 =?utf-8?B?bFdDNjRYVEwwVnBZQUl6R3lFYUZYdFlJNCtOQXRGY21IZmthNE9uUDJ0TFBV?=
 =?utf-8?B?aXYxdFVqcE5EelhCVTJaTXlndnI1ZGZ0MnpidGhwMkY4K2ZsaFRpNzQwSlc5?=
 =?utf-8?B?LzBPWU5ydWthZSttd1hQYXhmcXFQdDdKK1g1d0M0Z2xkVTJsWmJ5NzlzZEhW?=
 =?utf-8?B?OXN2NkZSSTVIdXl4TVhGYUZieEpzY094SGFtQUV4dFR3dU9uSVVMTGNKU1JB?=
 =?utf-8?B?ZUdWaGFCOU1idzhENzNKdHZncy9rL3dKVENCNWFMVFh4QUxCR2ZHbzhRV2E5?=
 =?utf-8?B?dXlTZHYyeGttellEa25KZ24xeGdQRVFCR3ljRitPcTE2eDhmek1kNW9wdmhU?=
 =?utf-8?B?bndvNmdkUGlOakkwNDZldDZMNUNScm93RFY2akpUb3phbEN0Tk9Yb2JHZkhI?=
 =?utf-8?B?ckduZk42LzdhdjMzWW5IQWk0SHhJdkd6SDhoVzJoNlVEUjNxVktPOG1XV2NX?=
 =?utf-8?B?Rks4Sk9DWXVBQlovZmJ1ZGRvenplYXV4Tm1USjJYa3NsbFg2NVNsQzNEUjds?=
 =?utf-8?B?cHI3Vi9vbEtoc2Y0STE2eEU1NHRqVjZTWlpFSUJ3OER3anA4cHliRHZML2Yr?=
 =?utf-8?B?aUlzZGVCSzVURS9xMzZka1hhLzkyNUZRbzZld2VhbUE2N1FGa2RSaUdUQTBQ?=
 =?utf-8?B?MmY1cHArYWg1VVU0eW1wQ0dIa2NPSzBRNlNFWXNZTkwyeDZra3lzbjUwQVh6?=
 =?utf-8?B?WXJjbXlXNnBXVitDMVpkMTArcktkQklqTTF5S05rbVc2QnR0QW5CQzdkVm51?=
 =?utf-8?B?Y0JzSGRpd3lrMW1GYmhuR2d5Qk1XWDM0QU9jSDRYa1FjZ3pjMU5OWlJnS1Bu?=
 =?utf-8?B?ZjllUmtGRlN0R2ZSbHp4TkxXdWpzaFA2R0hMMHliUHYrMEVTU214VDQ0REJV?=
 =?utf-8?B?c1VtanllZzFHeVN2cmlQU09KcVdJdll6U2Z5eWNGbjlLM3oxd3dUQlg4TXZp?=
 =?utf-8?B?cmFzZFlaaU9hUm5ZVjdTQUxJN2ROSktwbXk3MG5xanpLVUhGd1FYU0pEaE1D?=
 =?utf-8?B?NlBRSmQ0Yk5EbDRBN09TZTJvcHJNeSt1aXJ4eWdhY1U5bUtPRGtSMjBKd3NE?=
 =?utf-8?B?ZnZnU2JqV3VHY0JDSklhelRydUZWTjhtODZnOWtGOUVBRzlxTDgrZ3ozZjRJ?=
 =?utf-8?B?QW4zS0thNW9lT0gzT1I5WkVabFg4elJ6KzNmTWN5ZldLcWxpRndiWVVjMkY2?=
 =?utf-8?B?VTFUSjRhRWpWNnBLV2ptRFg1b0lIbWtRbmN4Sjk4eHk5dnhmaS82NE5uWVFn?=
 =?utf-8?B?R2s1M21iZE9sejNMQ3R6YUVDbzhSS25UcENLN0JnblVEamUzdUZvL2dDeHhj?=
 =?utf-8?Q?MTnQ=3D?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: de6ddc43-be41-40e0-b920-08d99f6c01ed
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1201MB0192.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Nov 2021 08:20:49.9771
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: OwniUC0qDFfGAlk7ixSn1imwDWiQ536aj5K2UXD68svcWEsGf8GL9+nZgZgUyTNe
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR1201MB0112
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Am 03.11.21 um 15:50 schrieb Michel Dänzer:
> On 2021-07-23 10:22, Christian König wrote:
>> Am 23.07.21 um 10:19 schrieb Michel Dänzer:
>>> On 2021-07-23 10:04 a.m., Christian König wrote:
>>>> Am 23.07.21 um 09:58 schrieb Michel Dänzer:
>>>>> From: Michel Dänzer <mdaenzer@redhat.com>
>>>>>
>>>>> This makes sure we don't hit the
>>>>>
>>>>>       BUG_ON(dmabuf->cb_in.active || dmabuf->cb_out.active);
>>>>>
>>>>> in dma_buf_release, which could be triggered by user space closing the
>>>>> dma-buf file description while there are outstanding fence callbacks
>>>>> from dma_buf_poll.
>>>> I was also wondering the same thing while working on this, but then thought that the poll interface would take care of this.
>>> I was able to hit the BUG_ON with https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgitlab.gnome.org%2FGNOME%2Fmutter%2F-%2Fmerge_requests%2F1880&amp;data=04%7C01%7Cchristian.koenig%40amd.com%7C8d930ab39011481a839c08d99ed95755%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637715479787056688%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=SjxSZIsWkP7ru1iHyL0IY9hN9882ENv7Cy38vzOtqyc%3D&amp;reserved=0 .
>>>
>>>
>>>>> Cc: stable@vger.kernel.org
>>>>> Signed-off-by: Michel Dänzer <mdaenzer@redhat.com>
>>>>> ---
>>>>>     drivers/dma-buf/dma-buf.c | 18 ++++++++++++------
>>>>>     1 file changed, 12 insertions(+), 6 deletions(-)
>>>>>
>>>>> diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
>>>>> index 6c520c9bd93c..ec25498a971f 100644
>>>>> --- a/drivers/dma-buf/dma-buf.c
>>>>> +++ b/drivers/dma-buf/dma-buf.c
>>>>> @@ -65,12 +65,9 @@ static void dma_buf_release(struct dentry *dentry)
>>>>>         BUG_ON(dmabuf->vmapping_counter);
>>>>>           /*
>>>>> -     * Any fences that a dma-buf poll can wait on should be signaled
>>>>> -     * before releasing dma-buf. This is the responsibility of each
>>>>> -     * driver that uses the reservation objects.
>>>>> -     *
>>>>> -     * If you hit this BUG() it means someone dropped their ref to the
>>>>> -     * dma-buf while still having pending operation to the buffer.
>>>>> +     * If you hit this BUG() it could mean:
>>>>> +     * * There's a file reference imbalance in dma_buf_poll / dma_buf_poll_cb or somewhere else
>>>>> +     * * dmabuf->cb_in/out.active are non-0 despite no pending fence callback
>>>>>          */
>>>>>         BUG_ON(dmabuf->cb_in.active || dmabuf->cb_out.active);
>>>>>     @@ -196,6 +193,7 @@ static loff_t dma_buf_llseek(struct file *file, loff_t offset, int whence)
>>>>>     static void dma_buf_poll_cb(struct dma_fence *fence, struct dma_fence_cb *cb)
>>>>>     {
>>>>>         struct dma_buf_poll_cb_t *dcb = (struct dma_buf_poll_cb_t *)cb;
>>>>> +    struct dma_buf *dmabuf = container_of(dcb->poll, struct dma_buf, poll);
>>>>>         unsigned long flags;
>>>>>           spin_lock_irqsave(&dcb->poll->lock, flags);
>>>>> @@ -203,6 +201,8 @@ static void dma_buf_poll_cb(struct dma_fence *fence, struct dma_fence_cb *cb)
>>>>>         dcb->active = 0;
>>>>>         spin_unlock_irqrestore(&dcb->poll->lock, flags);
>>>>>         dma_fence_put(fence);
>>>>> +    /* Paired with get_file in dma_buf_poll */
>>>>> +    fput(dmabuf->file);
>>>> Is calling fput() in interrupt context ok? IIRC that could potentially sleep.
>>> Looks fine AFAICT: It has
>>>
>>>          if (likely(!in_interrupt() && !(task->flags & PF_KTHREAD))) {
>>>
>>> and as a fallback for that, it adds the file to a lock-less delayed_fput_list which is processed by a workqueue.
>> Ah, yes that makes sense.
>>
>> Fell free to add Reviewed-by: Christian König <christian.koenig@amd.com>
> Thanks! AFAICT this fix can be merged now for 5.16?

I've just pushed it to drm-misc-next-fixes since it won't even apply to 
drm-misc-fixes.

Could be that we get requests to backport this because of the CC stable.

Christian.