target/linux/brcm2708/patches-4.19/950-0566-drm-v3d-Fix-a-use-after-free-race-accessing-the-sche.patch

   1 From d66b36c8443b24eab7512467095f7395d01f77de Mon Sep 17 00:00:00 2001
   2 From: Eric Anholt <eric@anholt.net>
   3 Date: Fri, 28 Sep 2018 16:21:23 -0700
   4 Subject: [PATCH 566/703] drm/v3d: Fix a use-after-free race accessing the
   5  scheduler's fences.
   6
   7 Once we push the job, the scheduler could run it and free it.  So, if
   8 we want to reference their fences, we need to grab them before then.
   9 I haven't seen this happen in many days of conformance test runtime,
  10 but let's still close the race.
  11
  12 Signed-off-by: Eric Anholt <eric@anholt.net>
  13 Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+")
  14 Link: https://patchwork.freedesktop.org/patch/254119/
  15 Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
  16 (cherry picked from commit 34c2c4f632f232ed2fdb66d4e42cc72d322273fe)
  17 ---
  18  drivers/gpu/drm/v3d/v3d_drv.h | 5 +++++
  19  drivers/gpu/drm/v3d/v3d_gem.c | 8 ++++++--
  20  2 files changed, 11 insertions(+), 2 deletions(-)
  21
  22 --- a/drivers/gpu/drm/v3d/v3d_drv.h
  23 +++ b/drivers/gpu/drm/v3d/v3d_drv.h
  24 @@ -198,6 +198,11 @@ struct v3d_exec_info {
  25          */
  26         struct dma_fence *bin_done_fence;
  27
  28 +       /* Fence for when the scheduler considers the render to be
  29 +        * done, for when the BOs reservations should be complete.
  30 +        */
  31 +       struct dma_fence *render_done_fence;
  32 +
  33         struct kref refcount;
  34
  35         /* This is the array of BOs that were looked up at the start of exec. */
  36 --- a/drivers/gpu/drm/v3d/v3d_gem.c
  37 +++ b/drivers/gpu/drm/v3d/v3d_gem.c
  38 @@ -209,7 +209,7 @@ v3d_flush_caches(struct v3d_dev *v3d)
  39  static void
  40  v3d_attach_object_fences(struct v3d_exec_info *exec)
  41  {
  42 -       struct dma_fence *out_fence = &exec->render.base.s_fence->finished;
  43 +       struct dma_fence *out_fence = exec->render_done_fence;
  44         struct v3d_bo *bo;
  45         int i;
  46
  47 @@ -409,6 +409,7 @@ v3d_exec_cleanup(struct kref *ref)
  48         dma_fence_put(exec->render.done_fence);
  49
  50         dma_fence_put(exec->bin_done_fence);
  51 +       dma_fence_put(exec->render_done_fence);
  52
  53         for (i = 0; i < exec->bo_count; i++)
  54                 drm_gem_object_put_unlocked(&exec->bo[i]->base);
  55 @@ -572,6 +573,9 @@ v3d_submit_cl_ioctl(struct drm_device *d
  56         if (ret)
  57                 goto fail_unreserve;
  58
  59 +       exec->render_done_fence =
  60 +               dma_fence_get(&exec->render.base.s_fence->finished);
  61 +
  62         kref_get(&exec->refcount); /* put by scheduler job completion */
  63         drm_sched_entity_push_job(&exec->render.base,
  64                                   &v3d_priv->sched_entity[V3D_RENDER]);
  65 @@ -585,7 +589,7 @@ v3d_submit_cl_ioctl(struct drm_device *d
  66         sync_out = drm_syncobj_find(file_priv, args->out_sync);
  67         if (sync_out) {
  68                 drm_syncobj_replace_fence(sync_out,
  69 -                                         &exec->render.base.s_fence->finished);
  70 +                                         exec->render_done_fence);
  71                 drm_syncobj_put(sync_out);
  72         }
  73