From patchwork Wed Nov 25 20:26:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeremy Cline X-Patchwork-Id: 333598 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B4375C63777 for ; Wed, 25 Nov 2020 20:27:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4B5E1206F7 for ; Wed, 25 Nov 2020 20:27:27 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="EnscSJBf" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729545AbgKYU1P (ORCPT ); Wed, 25 Nov 2020 15:27:15 -0500 Received: from us-smtp-delivery-124.mimecast.com ([63.128.21.124]:53219 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729354AbgKYU1P (ORCPT ); Wed, 25 Nov 2020 15:27:15 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1606336034; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=oyv7TmTJOo07L0V0MDDH9iBw1ZsQzWrWnebIO9wiR7I=; b=EnscSJBfWEnNQagyJKY06/SgSW401FLj3ogUTPHzjS0gMcSWPlGTgWRZ4+oZ0bsprMy35x ortU5LBeXqjgULkrJghCjEpW95Si3NJHbtwwrjodg13znf3W+A91LWELfQfkR/J87CkAUc wUJqjQoLuo6QL4oW1YZ2imNWBX7bOE4= Received: from mail-qt1-f198.google.com (mail-qt1-f198.google.com [209.85.160.198]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-170-XNa6kdt8PoS9W-nnnIOUDQ-1; Wed, 25 Nov 2020 15:27:12 -0500 X-MC-Unique: XNa6kdt8PoS9W-nnnIOUDQ-1 Received: by mail-qt1-f198.google.com with SMTP id y5so3245027qtb.13 for ; Wed, 25 Nov 2020 12:27:12 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=oyv7TmTJOo07L0V0MDDH9iBw1ZsQzWrWnebIO9wiR7I=; b=k9HY2dpyf1tgWQVrUFFqs/wNmSUMF5ty2P94YdVpuXpzDv//xjDAdWquhPfK46eApJ 9Us+VQ+3wMbtXodtMX0qZl57Z2seX/f4zsXmXyJagzp76QiAXm4yCJmWIAvRZjcHTDbP rmN4teSAo3OzN9Drr1Wh6UjC01vKnAcEMeNkAp9ggZIDA8x5B2nXhx2vI01gnProDrzZ MLLms6rhoQHNYiqMsBeEKmqWNSDH6eh7NJdfHn7gvzt7NwZNh7fV4AoKxKTN1kaaihNy K/568cxuBistVCXupIWyPf+WCGshvXWsau44nIgUTYI4eJJJmn9+cB/EYehL4D24kci+ d2nw== X-Gm-Message-State: AOAM533MFgI4gV2iXPmviIqwDBYufnCJNWPZXEANPvQM++4xGBk+ocj0 VXdu6pdvgGqJHkUy8c2xZ8ljGf6vGopoEn6RAaSFAVKy5u7Jrbyx4j06blfCE71Z8XfBWvF3UAh fpHZLicjDukwXv1LI X-Received: by 2002:aed:39c2:: with SMTP id m60mr663843qte.206.1606336031654; Wed, 25 Nov 2020 12:27:11 -0800 (PST) X-Google-Smtp-Source: ABdhPJyKH4xIOuYE9iphSs67b2xooUR1MwfVJh1L82U2A+W+f2xs7dI2EaoZEqdNs7n2LbREsN/4Fg== X-Received: by 2002:aed:39c2:: with SMTP id m60mr663825qte.206.1606336031489; Wed, 25 Nov 2020 12:27:11 -0800 (PST) Received: from dev.jcline.org ([2605:a601:a638:b301:9966:d978:493:6a3d]) by smtp.gmail.com with ESMTPSA id o187sm431772qkb.120.2020.11.25.12.27.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 25 Nov 2020 12:27:10 -0800 (PST) From: Jeremy Cline To: Ben Skeggs Cc: Lyude Paul , Karol Herbst , David Airlie , nouveau@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Jeremy Cline , stable@vger.kernel.org Subject: [PATCH v2 1/3] drm/nouveau: use drm_dev_unplug() during device removal Date: Wed, 25 Nov 2020 15:26:46 -0500 Message-Id: <20201125202648.5220-2-jcline@redhat.com> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201125202648.5220-1-jcline@redhat.com> References: <20201103194912.184413-1-jcline@redhat.com> <20201125202648.5220-1-jcline@redhat.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org Nouveau does not currently support hot-unplugging, but it still makes sense to switch from drm_dev_unregister() to drm_dev_unplug(). drm_dev_unplug() calls drm_dev_unregister() after marking the device as unplugged, but only after any device critical sections are finished. Since nouveau isn't using drm_dev_enter() and drm_dev_exit(), there are no critical sections so this is nearly functionally equivalent. However, the DRM layer does check to see if the device is unplugged, and if it is returns appropriate error codes. In the future nouveau can add critical sections in order to truly support hot-unplugging. Cc: stable@vger.kernel.org Signed-off-by: Jeremy Cline --- drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c index d141a5f004af..4fe4d664c5f2 100644 --- a/drivers/gpu/drm/nouveau/nouveau_drm.c +++ b/drivers/gpu/drm/nouveau/nouveau_drm.c @@ -792,7 +792,7 @@ nouveau_drm_device_remove(struct drm_device *dev) struct nvkm_client *client; struct nvkm_device *device; - drm_dev_unregister(dev); + drm_dev_unplug(dev); dev->irq_enabled = false; client = nvxx_client(&drm->client.base); From patchwork Wed Nov 25 20:26:47 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeremy Cline X-Patchwork-Id: 332902 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4C28C6379D for ; Wed, 25 Nov 2020 20:27:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8977C207BB for ; Wed, 25 Nov 2020 20:27:27 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="ecTPpWB9" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729597AbgKYU1S (ORCPT ); Wed, 25 Nov 2020 15:27:18 -0500 Received: from us-smtp-delivery-124.mimecast.com ([216.205.24.124]:31495 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729175AbgKYU1S (ORCPT ); Wed, 25 Nov 2020 15:27:18 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1606336036; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=m28TgjZwi7HhBuSwen4t4g93qkTs31I2N0RIyqGkBQY=; b=ecTPpWB9KnDY2ew0Nj2/tFIPHitjvc6+B138AXrO/Jgy3SfU80EXNm1bOl1Ynk7ohpMEXG EPJ4htHzV2pxjc4AR4YJ5B04g0AWzNPxPXbnkUnF5x2o2R7gNo4YkoxxVbuKlP+JClMfz0 GavdIUXiFbPEcr4sLlR70OJq90EsI8g= Received: from mail-qv1-f72.google.com (mail-qv1-f72.google.com [209.85.219.72]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-405-WvyK-rq6MiGI3V0gHXqujw-1; Wed, 25 Nov 2020 15:27:14 -0500 X-MC-Unique: WvyK-rq6MiGI3V0gHXqujw-1 Received: by mail-qv1-f72.google.com with SMTP id cu18so3208842qvb.17 for ; Wed, 25 Nov 2020 12:27:14 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=m28TgjZwi7HhBuSwen4t4g93qkTs31I2N0RIyqGkBQY=; b=W7SsmQpGgUaJYhQpdxwkGaNGJMSp1rruG/WZyko06lHKSUTTKHppeETUVo6iyuPAXM gNQpnv4PbTOgEHvrRjmzuZIbQIo4ay8rtyqqa/X/IlBsBj0cq6Plpu+xSYsHL7UmsL1h kIzUT5oAiLoKwUHBzegEuhKjNawf+EDLTngxT0iCc0mrrhn4963ctzOTUbZmNeVJQh1X CCWN/vKZCyU1COgBjFVPOpO5tig9dXyvRteHmVKtx1qW+sYEPKZnT/P7amycVlUE/vJ0 x3myZjwGDPVT3ORRi/i3S6ZVrtjfrZ1+zYGu9BPiTnXnDxcaZgWpf4kqIRuCWsT0yduk d6jw== X-Gm-Message-State: AOAM533YeF04yijvjz2RI5UR+gZsDBj5B/RohFItFqqxBaIyMjDn4er1 8T7Vlxwd4uSX6U2kfoCVROkSNOmhE8QHvHiJ/CQgRoXSbhrxWGFJTDx/oFUGWnul5Tc38PzUAf/ KzMKKevoRDDKkVlwV X-Received: by 2002:a37:4854:: with SMTP id v81mr748205qka.20.1606336033967; Wed, 25 Nov 2020 12:27:13 -0800 (PST) X-Google-Smtp-Source: ABdhPJwTVi4YITmr/yVt0UXkpzCkoAdVjZcIU7pnzNdwrA6y0qo2w8G8fpzl3w+LvWzcj9VOPAQxLw== X-Received: by 2002:a37:4854:: with SMTP id v81mr748193qka.20.1606336033788; Wed, 25 Nov 2020 12:27:13 -0800 (PST) Received: from dev.jcline.org ([2605:a601:a638:b301:9966:d978:493:6a3d]) by smtp.gmail.com with ESMTPSA id o187sm431772qkb.120.2020.11.25.12.27.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 25 Nov 2020 12:27:13 -0800 (PST) From: Jeremy Cline To: Ben Skeggs Cc: Lyude Paul , Karol Herbst , David Airlie , nouveau@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Jeremy Cline , stable@vger.kernel.org Subject: [PATCH v2 2/3] drm/nouveau: Add a dedicated mutex for the clients list Date: Wed, 25 Nov 2020 15:26:47 -0500 Message-Id: <20201125202648.5220-3-jcline@redhat.com> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201125202648.5220-1-jcline@redhat.com> References: <20201103194912.184413-1-jcline@redhat.com> <20201125202648.5220-1-jcline@redhat.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org Rather than protecting the nouveau_drm clients list with the lock within the "client" nouveau_cli, add a dedicated lock to serialize access to the list. This is both clearer and necessary to avoid lockdep being upset with us when we need to iterate through all the clients in the list and potentially lock their mutex, which is the same class as the lock protecting the entire list. Cc: stable@vger.kernel.org Signed-off-by: Jeremy Cline --- Changes since v1: - Add a mutex_destroy() call when destroying the device struct drivers/gpu/drm/nouveau/nouveau_drm.c | 10 ++++++---- drivers/gpu/drm/nouveau/nouveau_drv.h | 5 +++++ 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c index 4fe4d664c5f2..6ee1adc9bd40 100644 --- a/drivers/gpu/drm/nouveau/nouveau_drm.c +++ b/drivers/gpu/drm/nouveau/nouveau_drm.c @@ -557,6 +557,7 @@ nouveau_drm_device_init(struct drm_device *dev) nvkm_dbgopt(nouveau_debug, "DRM"); INIT_LIST_HEAD(&drm->clients); + mutex_init(&drm->clients_lock); spin_lock_init(&drm->tile.lock); /* workaround an odd issue on nvc1 by disabling the device's @@ -654,6 +655,7 @@ nouveau_drm_device_fini(struct drm_device *dev) nouveau_cli_fini(&drm->client); nouveau_cli_fini(&drm->master); nvif_parent_dtor(&drm->parent); + mutex_destroy(&drm->clients_lock); kfree(drm); } @@ -1089,9 +1091,9 @@ nouveau_drm_open(struct drm_device *dev, struct drm_file *fpriv) fpriv->driver_priv = cli; - mutex_lock(&drm->client.mutex); + mutex_lock(&drm->clients_lock); list_add(&cli->head, &drm->clients); - mutex_unlock(&drm->client.mutex); + mutex_unlock(&drm->clients_lock); done: if (ret && cli) { @@ -1117,9 +1119,9 @@ nouveau_drm_postclose(struct drm_device *dev, struct drm_file *fpriv) nouveau_abi16_fini(cli->abi16); mutex_unlock(&cli->mutex); - mutex_lock(&drm->client.mutex); + mutex_lock(&drm->clients_lock); list_del(&cli->head); - mutex_unlock(&drm->client.mutex); + mutex_unlock(&drm->clients_lock); nouveau_cli_fini(cli); kfree(cli); diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h index 9d04d1b36434..550e5f335146 100644 --- a/drivers/gpu/drm/nouveau/nouveau_drv.h +++ b/drivers/gpu/drm/nouveau/nouveau_drv.h @@ -141,6 +141,11 @@ struct nouveau_drm { struct list_head clients; + /** + * @clients_lock: Protects access to the @clients list of &struct nouveau_cli. + */ + struct mutex clients_lock; + u8 old_pm_cap; struct { From patchwork Wed Nov 25 20:26:48 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeremy Cline X-Patchwork-Id: 332901 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6FA9EC64E7C for ; Wed, 25 Nov 2020 20:27:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 15896207BB for ; Wed, 25 Nov 2020 20:27:28 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="HJQA+Qt8" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729742AbgKYU1U (ORCPT ); Wed, 25 Nov 2020 15:27:20 -0500 Received: from us-smtp-delivery-124.mimecast.com ([63.128.21.124]:50355 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729729AbgKYU1U (ORCPT ); Wed, 25 Nov 2020 15:27:20 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1606336038; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mHKnvKojNg07maTXpdLc7opl7LeH8NxJHEW+j33de5M=; b=HJQA+Qt8G+IaoQGfVjSj7kMvJ23y3zxbNgAEUP6d5d+2up91JJ7ex1vO1v3ISdXHWsJyNF NrgpFlo5rrQiLM4Ely10j3B/DAjjkTDr2vsbDamkLMO3irwxMTu3D8q7lC1oO83lY7lYfy k7SgSsHugVDADtF5opH93SOa1xRx+L4= Received: from mail-qv1-f69.google.com (mail-qv1-f69.google.com [209.85.219.69]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-582-NkbOk4J1NemeIitdTtDlaQ-1; Wed, 25 Nov 2020 15:27:16 -0500 X-MC-Unique: NkbOk4J1NemeIitdTtDlaQ-1 Received: by mail-qv1-f69.google.com with SMTP id o16so3270005qvq.4 for ; Wed, 25 Nov 2020 12:27:16 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=mHKnvKojNg07maTXpdLc7opl7LeH8NxJHEW+j33de5M=; b=O+uc5/SLuNbgGppNGBO0WAYdsFp35Lxn2TzZpycR17Tj0PduprXfX0zGi5XXnVhrnz m9t9MEy9a0iIewFXdWftbsbA9gKPDKTvXGxyv6+dO/VIWQoxyBqSk65/i9fejVakyl+G qpYwXvlCXlz8DjCl2SVfxZbBXWdZiBiNq4HyHauUwMiO5yVPsWe+OwZBz/8hRmZO8gBO lfW9JVsY/3pNgq9vZHZ9DmDnW2NxX4KNzS6OKNVlfeZhsD11MEdNiXUR4XwRHeq/g+ia oBLW7BXRReeybzNAN4OBLrY8IgEeMXeeolj6m3qWNxjQW7HrGA/OnjeK4CjAOhJap9V+ OvxA== X-Gm-Message-State: AOAM531bJOLB/sV6lJz38OYaDc3br2qYCkmHoOyMlxW4dmkgQfi7weqT 0l8MJ0GoDNNbv0UIHpydxyzWh/2nEl0OQJEK6DNOJPZWum8lzPZv9rESmBLlp55Z8WL2MF19/wP oIIeMDOJ6R88aiFIt X-Received: by 2002:a37:6f07:: with SMTP id k7mr645811qkc.423.1606336036383; Wed, 25 Nov 2020 12:27:16 -0800 (PST) X-Google-Smtp-Source: ABdhPJxIW7/SCjK5C7le3XLJ7c7SswM/9Tbl2wvjAUiYOJaHFKIGoPwGq/hxgNfwbsf46D2m+6cudA== X-Received: by 2002:a37:6f07:: with SMTP id k7mr645781qkc.423.1606336036152; Wed, 25 Nov 2020 12:27:16 -0800 (PST) Received: from dev.jcline.org ([2605:a601:a638:b301:9966:d978:493:6a3d]) by smtp.gmail.com with ESMTPSA id o187sm431772qkb.120.2020.11.25.12.27.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 25 Nov 2020 12:27:15 -0800 (PST) From: Jeremy Cline To: Ben Skeggs Cc: Lyude Paul , Karol Herbst , David Airlie , nouveau@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Jeremy Cline , stable@vger.kernel.org Subject: [PATCH v2 3/3] drm/nouveau: clean up all clients on device removal Date: Wed, 25 Nov 2020 15:26:48 -0500 Message-Id: <20201125202648.5220-4-jcline@redhat.com> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201125202648.5220-1-jcline@redhat.com> References: <20201103194912.184413-1-jcline@redhat.com> <20201125202648.5220-1-jcline@redhat.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org The postclose handler can run after the device has been removed (or the driver has been unbound) since userspace clients are free to hold the file open as long as they want. Because the device removal callback frees the entire nouveau_drm structure, any reference to it in the postclose handler will result in a use-after-free. To reproduce this, one must simply open the device file, unbind the driver (or physically remove the device), and then close the device file. This was found and can be reproduced easily with the IGT core_hotunplug tests. To avoid this, all clients are cleaned up in the device finalization rather than deferring it to the postclose handler, and the postclose handler is protected by a critical section which ensures the drm_dev_unplug() and the postclose handler won't race. This is not an ideal fix, since as I understand the proposed plan for the kernel<->userspace interface for hotplug support, destroying the client before the file is closed will cause problems. However, I believe to properly fix this issue, the lifetime of the nouveau_drm structure needs to be extended to match the drm_device, and this proved to be a rather invasive change. Thus, I've broken this out so the fix can be easily backported. Cc: stable@vger.kernel.org Signed-off-by: Jeremy Cline --- drivers/gpu/drm/nouveau/nouveau_drm.c | 30 +++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c index 6ee1adc9bd40..afaf1774ee35 100644 --- a/drivers/gpu/drm/nouveau/nouveau_drm.c +++ b/drivers/gpu/drm/nouveau/nouveau_drm.c @@ -628,6 +628,7 @@ nouveau_drm_device_init(struct drm_device *dev) static void nouveau_drm_device_fini(struct drm_device *dev) { + struct nouveau_cli *cli, *temp_cli; struct nouveau_drm *drm = nouveau_drm(dev); if (nouveau_pmops_runtime()) { @@ -652,6 +653,24 @@ nouveau_drm_device_fini(struct drm_device *dev) nouveau_ttm_fini(drm); nouveau_vga_fini(drm); + /* + * There may be existing clients from as-yet unclosed files. For now, + * clean them up here rather than deferring until the file is closed, + * but this likely not correct if we want to support hot-unplugging + * properly. + */ + mutex_lock(&drm->clients_lock); + list_for_each_entry_safe(cli, temp_cli, &drm->clients, head) { + list_del(&cli->head); + mutex_lock(&cli->mutex); + if (cli->abi16) + nouveau_abi16_fini(cli->abi16); + mutex_unlock(&cli->mutex); + nouveau_cli_fini(cli); + kfree(cli); + } + mutex_unlock(&drm->clients_lock); + nouveau_cli_fini(&drm->client); nouveau_cli_fini(&drm->master); nvif_parent_dtor(&drm->parent); @@ -1111,6 +1130,16 @@ nouveau_drm_postclose(struct drm_device *dev, struct drm_file *fpriv) { struct nouveau_cli *cli = nouveau_cli(fpriv); struct nouveau_drm *drm = nouveau_drm(dev); + int dev_index; + + /* + * The device is gone, and as it currently stands all clients are + * cleaned up in the removal codepath. In the future this may change + * so that we can support hot-unplugging, but for now we immediately + * return to avoid a double-free situation. + */ + if (!drm_dev_enter(dev, &dev_index)) + return; pm_runtime_get_sync(dev->dev); @@ -1127,6 +1156,7 @@ nouveau_drm_postclose(struct drm_device *dev, struct drm_file *fpriv) kfree(cli); pm_runtime_mark_last_busy(dev->dev); pm_runtime_put_autosuspend(dev->dev); + drm_dev_exit(dev_index); } static const struct drm_ioctl_desc