Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <c7cb225b-7f21-8d9a-773b-efc655e6332c@amd.com>
Date:   Sun, 7 Aug 2022 18:52:52 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.11.0
Subject: Re: [PATCH v2] drm/gem: Fix GEM handle release errors
Content-Language: en-US
To:     Jeffy Chen <jeffy.chen@rock-chips.com>,
        Daniel Vetter <daniel.vetter@ffwll.ch>
Cc:     Andy Yan <andy.yan@rock-chips.com>,
        Jianqun Xu <jay.xu@rock-chips.com>,
        Maxime Ripard <mripard@kernel.org>,
        Sumit Semwal <sumit.semwal@linaro.org>,
        Thomas Zimmermann <tzimmermann@suse.de>,
        linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org,
        linaro-mm-sig@lists.linaro.org, David Airlie <airlied@linux.ie>,
        Maarten Lankhorst <maarten.lankhorst@linux.intel.com>,
        linux-media@vger.kernel.org, Daniel Vetter <daniel@ffwll.ch>
References: <20220803083237.3701-1-jeffy.chen@rock-chips.com>
From:   =?UTF-8?Q?Christian_K=c3=b6nig?= <christian.koenig@amd.com>
In-Reply-To: <20220803083237.3701-1-jeffy.chen@rock-chips.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?SmF5UFhVazd5UGhxOXRsZDhxRXVTU2xpbGtCcm5hR1YxZTNiOGdkaXBFcThn?=
 =?utf-8?B?bUJrSHN1UWVRTkVVWlJSMURKNm8xdGJPck9uY2Jzd3BpQk1pclRlRGJ1bnA1?=
 =?utf-8?B?N1ZQNElZWkNJaVVqNDFCdU1yTVVqb09ocm05U0VQNFdhR2hLZGpJNThYMzNo?=
 =?utf-8?B?a0lOUXh6L0xITGFKQlVQQU10d29Rd3lGZWFOSTVsRjRrZ2xQUThFVmtWUHNx?=
 =?utf-8?B?TEVYRzFoSzludWFpdFhjUkphbVFQczY1RVBDcGhBUjJFdCtzemYyUE81M1Np?=
 =?utf-8?B?bkg5MngwVXpLSFhIOFcwOUd1STJ6d1l1RFJNcU53eEFFUXlXeVNTbDAwRmZK?=
 =?utf-8?B?Rll6U2Q5ZVZnaTFJVElrNUVVd0d5eHIxbUpDNS90WDNLMkhCc1MwL0xrblJG?=
 =?utf-8?B?a2grOEF4eS9rWkhTS1p0ampNNVJ6cDlJMENkU1pGSWVWVkRCUUdyby9mZzBn?=
 =?utf-8?B?Z0pKSDBNS0NJQXozak5DV1RBWFhjWlZjaElEc0ZKUjZrRkhPc3hzZzFETDBw?=
 =?utf-8?B?bWdjU2g3MjAxK0FxeDFEVXhuZjN4bmRsTldoNzdMNDBOd2JLWi9TUzI0d3ZN?=
 =?utf-8?B?VHh0MmtwcGd6ckVFY2hyVTRLanZRTG54VnNMcjVrNVdkYlRNTFcrM2RTbnVq?=
 =?utf-8?B?T2VlYXNITmhIU2ZBZUtuZGFlZCtEcjNoQkVJL3YxOXRoR0lTVmd5bHFTVzBn?=
 =?utf-8?B?bzJpc3diWGxhT2VXSGZyQ1hoNXMrQko0RDhFSjFYaUJrKzluRUV5b3hDZy9D?=
 =?utf-8?B?RHk5Uno1bDRVUnNsQlZSUWdPenJUR2lsRTMvMU9sUDZOM2dYL0M0T2FnMnQw?=
 =?utf-8?B?NzQxVVBlMGZNT1E4V1lCclAxY0x5YWEwY1ZlVC9FdHJxUXVXQUM0M0pTaDNm?=
 =?utf-8?B?d1BNS2pKYVE5eWtvdFNuMXA3VVp5Q215NmNXRFgycEpuaFFxTmRQUENCSlgz?=
 =?utf-8?B?T09HR3I0bU5ySTBhZHlzWlVCWkZNcWFXMUYzdVQrV0U5L3dCa2xrUmxpaVdn?=
 =?utf-8?B?clJmSVRzMUtYNTFDSi9tZHRiWFpxak5ucFJSbkhlZmlpRWpoTUtpRVN5ZUJi?=
 =?utf-8?B?OTVwQmdLWlUxbUlxdENQSHBqWGdvcTc1eVRJdTNyTXQ2dkJyQTgyNDdzU1Vy?=
 =?utf-8?B?MjM3WFZoVnk5L2RGUDBEMjI3Rkt3aWdYYjVDa1d6UVNIc3FpeDllNkxRaW5v?=
 =?utf-8?B?Q2dyMmhsaGt5R2xsUkJFcFk5cWRWckl6em9ySWFHdWU2Mjgzckg0T1h6TWJX?=
 =?utf-8?B?cE5MRVN5cEI5M1lQdWp4RFFYdWlIYTh5T25qN2NpekgzVlFmSEVNVmdzaTJ3?=
 =?utf-8?B?bWord3ZhUnFaSVhQRGVvYXoyNHIvQnlHZnE0Q2JrSUNISU1RNzVaYlAzbFZa?=
 =?utf-8?B?SkJoMDM0R1phU1Y3b1dYY20xc1FXbjh5NlZTRytHVmYrSWVMYnA5Mi9NNVo1?=
 =?utf-8?B?OCtTQTJMSXFaenpoOXZOM3lhOGlKQzk0NkpZT1A0dzdHQ3RvUXc3aFJvOUVX?=
 =?utf-8?B?TExqcldWeUJtaDNaNm5Yby9ja0tvR2g4Uzl1OEtYcUpEd0Q1RjdUU2ZkSm1X?=
 =?utf-8?B?aGU4Z2M5TjM3YzJUSnFuU0tXWHlTSlhGNGpudkhvVkw0RlJHQzBZbVZuMy9r?=
 =?utf-8?B?dWVNTm5zTXBmTVZXNENqZGkrR01vdG9JdDNmWkc5bjdHeUNtNU1pVkUwdVpD?=
 =?utf-8?B?VFh4aXp6b0ZvdFpWRDdXSEhhdlh1bjdUYWdtbCtWWkpDVG8rVEQxeTNycU9n?=
 =?utf-8?B?VkEwdy9EQXRHQlFDTE16QzAwK3VIY2V3aGRSbjkwNUhQTTBXTTRsN0Y0b2Iy?=
 =?utf-8?B?ZUI0cWtNK3FTZEV2THFrSjRKV3FPV09nMmVPdXUzajIrSjBvOXNWWU9rSzJk?=
 =?utf-8?B?bmZZbXE4ZGRlcXh2YUppWnB6UmJUTDRIOGtUYkd5SGJVK0tRTEcxZUhBRUlL?=
 =?utf-8?B?WkV2dkdicjUyZTlVaTBQR1EwbGdic2g5S2RuVG5LVmZIM29VdHlRODVLZlBZ?=
 =?utf-8?B?VGprT2U5bFFueTJnUEhuV05XR0MzbjBzcUFhQ21laFVrbHh2YzdBaGFBUFN4?=
 =?utf-8?B?L3o1QmV2cVJxMnh5V3lVckF2M2RNZFFXNzRNL3ovODZta2NSclVlOVA2aXha?=
 =?utf-8?B?YkhId251ZEdlMmxkZGZ6R29QTXJXRFlmUU5lSEtjWEVwOVBFTkR3SjZselZC?=
 =?utf-8?Q?Zf7rDunt/qWzAxeL2eKeLNdoQKpGqN0HZJ1tcCZi85pC?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 32287421-1f99-4e15-7908-08da78954820
X-MS-Exchange-CrossTenant-AuthSource: BN8PR12MB3587.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Aug 2022 16:52:58.3300
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 0C8F1VPpx3DZXr8u+a5Zz2V7xffO0ILYHH+fKRpUf4BnPrnlpCJSESV4vpqbyw3b
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR12MB1729
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Am 03.08.22 um 10:32 schrieb Jeffy Chen:
> Currently we are assuming a one to one mapping between dmabuf and handle
> when releasing GEM handles.
>
> But that is not always true, since we would create extra handles for the
> GEM obj in cases like gem_open() and getfb{,2}().
>
> A similar issue was reported at:
> https://lore.kernel.org/all/20211105083308.392156-1-jay.xu@rock-chips.com/
>
> Another problem is that the drm_gem_remove_prime_handles() now only
> remove handle to the exported dmabuf (gem_obj->dma_buf), so the imported
> ones would leak:
> WARNING: CPU: 2 PID: 236 at drivers/gpu/drm/drm_prime.c:228 drm_prime_destroy_file_private+0x18/0x24
>
> Let's fix these by using handle to find the exact map to remove.

Well we are clearly something missing here. As far as I can see the 
current code is correct.

Creating multiple GEM handles for the same DMA-buf is possible, but illegal.

In other words when a GEM handle is exported as DMA-buf and imported 
again you should intentionally always get the same handle.

So this is pretty much a clear NAK to this patch since it shouldn't be 
necessary or something is seriously broken somewhere else.

Regards,
Christian.

>
> Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
> ---
>
> Changes in v2:
> Fix a typo of rbtree.
>
>   drivers/gpu/drm/drm_gem.c      | 17 +----------------
>   drivers/gpu/drm/drm_internal.h |  4 ++--
>   drivers/gpu/drm/drm_prime.c    | 20 ++++++++++++--------
>   3 files changed, 15 insertions(+), 26 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
> index eb0c2d041f13..ed39da383570 100644
> --- a/drivers/gpu/drm/drm_gem.c
> +++ b/drivers/gpu/drm/drm_gem.c
> @@ -168,21 +168,6 @@ void drm_gem_private_object_init(struct drm_device *dev,
>   }
>   EXPORT_SYMBOL(drm_gem_private_object_init);
>   
> -static void
> -drm_gem_remove_prime_handles(struct drm_gem_object *obj, struct drm_file *filp)
> -{
> -	/*
> -	 * Note: obj->dma_buf can't disappear as long as we still hold a
> -	 * handle reference in obj->handle_count.
> -	 */
> -	mutex_lock(&filp->prime.lock);
> -	if (obj->dma_buf) {
> -		drm_prime_remove_buf_handle_locked(&filp->prime,
> -						   obj->dma_buf);
> -	}
> -	mutex_unlock(&filp->prime.lock);
> -}
> -
>   /**
>    * drm_gem_object_handle_free - release resources bound to userspace handles
>    * @obj: GEM object to clean up.
> @@ -253,7 +238,7 @@ drm_gem_object_release_handle(int id, void *ptr, void *data)
>   	if (obj->funcs->close)
>   		obj->funcs->close(obj, file_priv);
>   
> -	drm_gem_remove_prime_handles(obj, file_priv);
> +	drm_prime_remove_buf_handle(&file_priv->prime, id);
>   	drm_vma_node_revoke(&obj->vma_node, file_priv);
>   
>   	drm_gem_object_handle_put_unlocked(obj);
> diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h
> index 1fbbc19f1ac0..7bb98e6a446d 100644
> --- a/drivers/gpu/drm/drm_internal.h
> +++ b/drivers/gpu/drm/drm_internal.h
> @@ -74,8 +74,8 @@ int drm_prime_fd_to_handle_ioctl(struct drm_device *dev, void *data,
>   
>   void drm_prime_init_file_private(struct drm_prime_file_private *prime_fpriv);
>   void drm_prime_destroy_file_private(struct drm_prime_file_private *prime_fpriv);
> -void drm_prime_remove_buf_handle_locked(struct drm_prime_file_private *prime_fpriv,
> -					struct dma_buf *dma_buf);
> +void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpriv,
> +				 uint32_t handle);
>   
>   /* drm_drv.c */
>   struct drm_minor *drm_minor_acquire(unsigned int minor_id);
> diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
> index e3f09f18110c..bd5366b16381 100644
> --- a/drivers/gpu/drm/drm_prime.c
> +++ b/drivers/gpu/drm/drm_prime.c
> @@ -190,29 +190,33 @@ static int drm_prime_lookup_buf_handle(struct drm_prime_file_private *prime_fpri
>   	return -ENOENT;
>   }
>   
> -void drm_prime_remove_buf_handle_locked(struct drm_prime_file_private *prime_fpriv,
> -					struct dma_buf *dma_buf)
> +void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpriv,
> +				 uint32_t handle)
>   {
>   	struct rb_node *rb;
>   
> -	rb = prime_fpriv->dmabufs.rb_node;
> +	mutex_lock(&prime_fpriv->lock);
> +
> +	rb = prime_fpriv->handles.rb_node;
>   	while (rb) {
>   		struct drm_prime_member *member;
>   
> -		member = rb_entry(rb, struct drm_prime_member, dmabuf_rb);
> -		if (member->dma_buf == dma_buf) {
> +		member = rb_entry(rb, struct drm_prime_member, handle_rb);
> +		if (member->handle == handle) {
>   			rb_erase(&member->handle_rb, &prime_fpriv->handles);
>   			rb_erase(&member->dmabuf_rb, &prime_fpriv->dmabufs);
>   
> -			dma_buf_put(dma_buf);
> +			dma_buf_put(member->dma_buf);
>   			kfree(member);
> -			return;
> -		} else if (member->dma_buf < dma_buf) {
> +			break;
> +		} else if (member->handle < handle) {
>   			rb = rb->rb_right;
>   		} else {
>   			rb = rb->rb_left;
>   		}
>   	}
> +
> +	mutex_unlock(&prime_fpriv->lock);
>   }
>   
>   void drm_prime_init_file_private(struct drm_prime_file_private *prime_fpriv)