diff options
author | Noralf Trønnes | 2019-02-08 15:01:02 +0100 |
---|---|---|
committer | Greg Kroah-Hartman | 2019-05-04 09:20:19 +0200 |
commit | c5eb9a424ebd2d9f9e3cccdf2bfbb415c2921261 (patch) | |
tree | 91092d1da3d9c737c7cd3efe1033ecae8a14ebb2 /drivers/gpu/drm/drm_file.c | |
parent | net: ethernet: ti: fix possible object reference leak (diff) | |
download | kernel-qcow2-linux-c5eb9a424ebd2d9f9e3cccdf2bfbb415c2921261.tar.gz kernel-qcow2-linux-c5eb9a424ebd2d9f9e3cccdf2bfbb415c2921261.tar.xz kernel-qcow2-linux-c5eb9a424ebd2d9f9e3cccdf2bfbb415c2921261.zip |
drm: Fix drm_release() and device unplug
[ Upstream commit 3f04e0a6cfebf48152ac64502346cdc258811f79 ]
If userspace has open fd(s) when drm_dev_unplug() is run, it will result
in drm_dev_unregister() being called twice. First in drm_dev_unplug() and
then later in drm_release() through the call to drm_put_dev().
Since userspace already holds a ref on drm_device through the drm_minor,
it's not necessary to add extra ref counting based on no open file
handles. Instead just drm_dev_put() unconditionally in drm_dev_unplug().
We now have this:
- Userpace holds a ref on drm_device as long as there's open fd(s)
- The driver holds a ref on drm_device as long as it's bound to the
struct device
When both sides are done with drm_device, it is released.
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Reviewed-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Sean Paul <sean@poorly.run>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190208140103.28919-2-noralf@tronnes.org
Signed-off-by: Sasha Levin (Microsoft) <sashal@kernel.org>
Diffstat (limited to 'drivers/gpu/drm/drm_file.c')
-rw-r--r-- | drivers/gpu/drm/drm_file.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c index ffa8dc35515f..e4ccb52c67ea 100644 --- a/drivers/gpu/drm/drm_file.c +++ b/drivers/gpu/drm/drm_file.c @@ -479,11 +479,9 @@ int drm_release(struct inode *inode, struct file *filp) drm_file_free(file_priv); - if (!--dev->open_count) { + if (!--dev->open_count) drm_lastclose(dev); - if (drm_dev_is_unplugged(dev)) - drm_put_dev(dev); - } + mutex_unlock(&drm_global_mutex); drm_minor_release(minor); |