mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-27 22:51:31 +00:00
0b0860a3cf
Currently, drm_file.master pointers should be protected by drm_device.master_mutex when being dereferenced. This is because drm_file.master is not invariant for the lifetime of drm_file. If drm_file is not the creator of master, then drm_file.is_master is false, and a call to drm_setmaster_ioctl will invoke drm_new_set_master, which then allocates a new master for drm_file and puts the old master. Thus, without holding drm_device.master_mutex, the old value of drm_file.master could be freed while it is being used by another concurrent process. However, it is not always possible to lock drm_device.master_mutex to dereference drm_file.master. Through the fbdev emulation code, this might occur in a deep nest of other locks. But drm_device.master_mutex is also the outermost lock in the nesting hierarchy, so this leads to potential deadlocks. To address this, we introduce a new spin lock at the bottom of the lock hierarchy that only serializes drm_file.master. With this change, the value of drm_file.master changes only when both drm_device.master_mutex and drm_file.master_lookup_lock are held. Hence, any process holding either of those locks can ensure that the value of drm_file.master will not change concurrently. Since no lock depends on the new drm_file.master_lookup_lock, when drm_file.master is dereferenced, but drm_device.master_mutex cannot be held, we can safely protect the master pointer with drm_file.master_lookup_lock. Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-5-desmondcheongzx@gmail.com |
||
---|---|---|
.. | ||
bridge | ||
i2c | ||
ttm | ||
amd_asic_type.h | ||
drm_aperture.h | ||
drm_atomic.h | ||
drm_atomic_helper.h | ||
drm_atomic_state_helper.h | ||
drm_atomic_uapi.h | ||
drm_audio_component.h | ||
drm_auth.h | ||
drm_blend.h | ||
drm_bridge.h | ||
drm_bridge_connector.h | ||
drm_cache.h | ||
drm_client.h | ||
drm_color_mgmt.h | ||
drm_connector.h | ||
drm_crtc.h | ||
drm_crtc_helper.h | ||
drm_damage_helper.h | ||
drm_debugfs.h | ||
drm_debugfs_crc.h | ||
drm_device.h | ||
drm_displayid.h | ||
drm_dp_aux_bus.h | ||
drm_dp_dual_mode_helper.h | ||
drm_dp_helper.h | ||
drm_dp_mst_helper.h | ||
drm_drv.h | ||
drm_dsc.h | ||
drm_edid.h | ||
drm_encoder.h | ||
drm_encoder_slave.h | ||
drm_fb_cma_helper.h | ||
drm_fb_helper.h | ||
drm_file.h | ||
drm_fixed.h | ||
drm_flip_work.h | ||
drm_format_helper.h | ||
drm_fourcc.h | ||
drm_framebuffer.h | ||
drm_gem.h | ||
drm_gem_atomic_helper.h | ||
drm_gem_cma_helper.h | ||
drm_gem_framebuffer_helper.h | ||
drm_gem_shmem_helper.h | ||
drm_gem_ttm_helper.h | ||
drm_gem_vram_helper.h | ||
drm_hashtab.h | ||
drm_hdcp.h | ||
drm_ioctl.h | ||
drm_irq.h | ||
drm_lease.h | ||
drm_legacy.h | ||
drm_managed.h | ||
drm_mipi_dbi.h | ||
drm_mipi_dsi.h | ||
drm_mm.h | ||
drm_mode_config.h | ||
drm_mode_object.h | ||
drm_modes.h | ||
drm_modeset_helper.h | ||
drm_modeset_helper_vtables.h | ||
drm_modeset_lock.h | ||
drm_of.h | ||
drm_panel.h | ||
drm_pciids.h | ||
drm_plane.h | ||
drm_plane_helper.h | ||
drm_prime.h | ||
drm_print.h | ||
drm_probe_helper.h | ||
drm_property.h | ||
drm_rect.h | ||
drm_scdc_helper.h | ||
drm_self_refresh_helper.h | ||
drm_simple_kms_helper.h | ||
drm_syncobj.h | ||
drm_sysfs.h | ||
drm_util.h | ||
drm_utils.h | ||
drm_vblank.h | ||
drm_vblank_work.h | ||
drm_vma_manager.h | ||
drm_writeback.h | ||
gma_drm.h | ||
gpu_scheduler.h | ||
gud.h | ||
i915_component.h | ||
i915_drm.h | ||
i915_mei_hdcp_interface.h | ||
i915_pciids.h | ||
intel-gtt.h | ||
intel_lpe_audio.h | ||
spsc_queue.h | ||
task_barrier.h |