Module Name: src
Committed By: riastradh
Date: Tue Feb 15 18:14:18 UTC 2022
Modified Files:
src/sys/external/bsd/drm2/dist/drm/i915: i915_active.c
Log Message:
Revert "i915: Defer final wakeup on active until after retirement."
This reverts i915_active.c 1.11. ref->retire might free the object,
so touching it is not allowed -- that would use-after-free. Linux
uses the object only for its address with wake_up_var.
The reason I made this change was that I guessed i915_active_wait has
to wait until after ref->retire finishes -- after all, Linux seems to
defer the wakeup until then. However, even the Linux code doesn't
guarantee this, because i915_active_wait could be called _during_
ref->retire, and would witness ref->count == 0, and would not wait
until it has completed in that case. So maybe my guess was wrong,
and it is OK for i915_active_wait to return while ref->retire is
still in flight -- I don't see any logic that obviously requires it
to wait for ref->retire, in any case.
Or maybe something does rely on i915_active_wait to wait for
ref->retire to finish, in which case we need a different mechanism
for i915_active_release itself to wait until i915_active_retire has
woken up, without dereferencing ref since it might be dead after
ref->retire.
To generate a diff of this commit:
cvs rdiff -u -r1.11 -r1.12 \
src/sys/external/bsd/drm2/dist/drm/i915/i915_active.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/external/bsd/drm2/dist/drm/i915/i915_active.c
diff -u src/sys/external/bsd/drm2/dist/drm/i915/i915_active.c:1.11 src/sys/external/bsd/drm2/dist/drm/i915/i915_active.c:1.12
--- src/sys/external/bsd/drm2/dist/drm/i915/i915_active.c:1.11 Mon Feb 14 20:37:51 2022
+++ src/sys/external/bsd/drm2/dist/drm/i915/i915_active.c Tue Feb 15 18:14:18 2022
@@ -1,4 +1,4 @@
-/* $NetBSD: i915_active.c,v 1.11 2022/02/14 20:37:51 riastradh Exp $ */
+/* $NetBSD: i915_active.c,v 1.12 2022/02/15 18:14:18 riastradh Exp $ */
/*
* SPDX-License-Identifier: MIT
@@ -7,7 +7,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: i915_active.c,v 1.11 2022/02/14 20:37:51 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: i915_active.c,v 1.12 2022/02/15 18:14:18 riastradh Exp $");
#include <linux/debugobjects.h>
@@ -195,6 +195,8 @@ __active_retire(struct i915_active *ref)
#endif
ref->cache = NULL;
+ DRM_SPIN_WAKEUP_ALL(&ref->tree_wq, &ref->tree_lock);
+
spin_unlock_irqrestore(&ref->tree_lock, flags);
/* After the final retire, the entire struct may be freed */
@@ -202,9 +204,6 @@ __active_retire(struct i915_active *ref)
ref->retire(ref);
/* ... except if you wait on it, you must manage your own references! */
- spin_lock(&ref->tree_lock);
- DRM_SPIN_WAKEUP_ALL(&ref->tree_wq, &ref->tree_lock);
- spin_unlock(&ref->tree_lock);
rbtree_postorder_for_each_entry_safe(it, n, &root, node) {
GEM_BUG_ON(i915_active_fence_isset(&it->base));
