Re: [PATCH] drm: Remove "protection" around drm_vma_offset_manager_destroy()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, Sep 03, 2018 at 10:31:55AM +0100, Chris Wilson wrote:
> Using a spinlock to serialize the destroy function, within the destroy
> function itself does not prevent the buggy driver from shooting
> themselves in the foot - either way they still have a use-after-free
> issue.
> 
> Reported-by: Jia-Ju Bai <baijiaju1990@xxxxxxxxx>
> Signed-off-by: Chris Wilson <chris@xxxxxxxxxxxxxxxxxx>
> Cc: Davidlohr Bueso <dave@xxxxxxxxxxxx>
> Cc: Liviu Dudau <Liviu.Dudau@xxxxxxx>
> Cc: Daniel Vetter <daniel.vetter@xxxxxxxx>

Ah, now I understand a bit more ...

Reviewed-by: Daniel Vetter <daniel.vetter@xxxxxxxx>
> ---
>  drivers/gpu/drm/drm_vma_manager.c | 3 ---
>  1 file changed, 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_vma_manager.c b/drivers/gpu/drm/drm_vma_manager.c
> index a6b2fe36b025..c5d0d2358301 100644
> --- a/drivers/gpu/drm/drm_vma_manager.c
> +++ b/drivers/gpu/drm/drm_vma_manager.c
> @@ -103,10 +103,7 @@ EXPORT_SYMBOL(drm_vma_offset_manager_init);
>   */
>  void drm_vma_offset_manager_destroy(struct drm_vma_offset_manager *mgr)
>  {
> -	/* take the lock to protect against buggy drivers */
> -	write_lock(&mgr->vm_lock);
>  	drm_mm_takedown(&mgr->vm_addr_space_mm);
> -	write_unlock(&mgr->vm_lock);
>  }
>  EXPORT_SYMBOL(drm_vma_offset_manager_destroy);
>  
> -- 
> 2.19.0.rc1
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/intel-gfx




[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux