On Tue, Feb 04, 2020 at 03:03:43PM +0100, Christian König wrote:
> Am 04.02.20 um 13:57 schrieb Dan Carpenter:
> > Hello Christian König,
> >
> > The patch bd4264112f93: "drm/ttm: fix re-init of global structures"
> > from Apr 16, 2019, leads to the following static checker warning:
> >
> > drivers/gpu/drm/ttm/ttm_bo.c:1610 ttm_bo_global_release()
> > warn: passing freed memory 'glob'
> >
> > drivers/gpu/drm/ttm/ttm_bo.c
> > 1591 static void ttm_bo_global_kobj_release(struct kobject *kobj)
> > 1592 {
> > 1593 struct ttm_bo_global *glob =
> > 1594 container_of(kobj, struct ttm_bo_global, kobj);
> > 1595
> > 1596 __free_page(glob->dummy_read_page);
> > 1597 }
> > 1598
> > 1599 static void ttm_bo_global_release(void)
> > 1600 {
> > 1601 struct ttm_bo_global *glob = &ttm_bo_glob;
> > 1602
> > 1603 mutex_lock(&ttm_global_mutex);
> > 1604 if (--ttm_bo_glob_use_count > 0)
> > 1605 goto out;
> > 1606
> > 1607 kobject_del(&glob->kobj);
> > 1608 kobject_put(&glob->kobj);
> > 1609 ttm_mem_global_release(&ttm_mem_glob);
> > 1610 memset(glob, 0, sizeof(*glob));
> > ^^^^^^^^^^^^^^^^^^^^^^
> > Depending on the config kobject_release() might call ttm_bo_global_kobj_release()
> > a few seconds after this memset. Maybe put the memset into
> > ttm_bo_global_kobj_release()?
>
> That's not possible. The object might be re-used directly after we drop the
> ttm_global_mutex.
>
Hm... That sucks. If we reallocate glob->dummy_read_page before the
ttm_bo_global_kobj_release() gets called then we're toasted.
> How can we wait for the ttm_mem_global_release() to have finished?
>
A bunch of these release functions use a completion. But you probably
don't want a four second delay before we can re-use the struct.
regards,
dan carpenter
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/dri-devel
