Commit f175b745 authored by Francisco Jerez's avatar Francisco Jerez Committed by Ben Skeggs
Browse files

drm/nouveau: Fix race condition in channel refcount handling. 



nouveau_channel_put() can be executed after the 'refcount == 0' check
in nouveau_channel_get() and before the channel reference count is
incremented. In that case CPU0 will take the context down while CPU1
thinks it owns the channel and 'refcount == 1'.

Signed-off-by: default avatarFrancisco Jerez <currojerez@riseup.net>
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
parent 3945e475

drivers/gpu/drm/nouveau/nouveau_channel.c

+2 −3
Original line number Diff line number Diff line
@@ -247,17 +247,16 @@ nouveau_channel_get(struct drm_device *dev, struct drm_file *file_priv, int id) 
	spin_lock_irqsave(&dev_priv->channels.lock, flags);

	chan = dev_priv->channels.ptr[id];



	if (unlikely(!chan || atomic_read(&chan->refcount) == 0)) {

	if (unlikely(!chan || (file_priv && chan->file_priv != file_priv))) {

		spin_unlock_irqrestore(&dev_priv->channels.lock, flags);

		return ERR_PTR(-EINVAL);

	}



	if (unlikely(file_priv && chan->file_priv != file_priv)) {

	if (unlikely(!atomic_inc_not_zero(&chan->refcount))) {

		spin_unlock_irqrestore(&dev_priv->channels.lock, flags);

		return ERR_PTR(-EINVAL);

	}



	atomic_inc(&chan->refcount);

	spin_unlock_irqrestore(&dev_priv->channels.lock, flags);



	mutex_lock(&chan->mutex);