nouveau: fix client work fence deletion race

This seems to have existed for ever but is now more apparant after commit 9bff18d13473 ("drm/ttm: use per BO cleanup workers") My analysis: two threads are running, one in the irq signalling the fence, in dma_fence_signal_timestamp_locked, it has done the DMA_FENCE_FLAG_SIGNALLED_BIT setting, but hasn't yet reached the callbacks. The second thread in nouveau_cli_work_ready, where it sees the fence is signalled, so then puts the fence, cleanups the object and frees the work item, which contains the callback. Thread one goes again and tries to call the callback and causes the use-after-free. Proposed fix: lock the fence signalled check in nouveau_cli_work_ready, so either the callbacks are done or the memory is freed.

Dave Airlie committed 3 years ago

Commit c8a5d5e1 parent c8ac1091 file · +10 −4Browse files

Unified · Split

drivers/gpu/drm/nouveau/nouveau_drm.c+10−4

@@ -137,10 +137,16 @@ nouveau_name(struct drm_device *dev) · 136 unmodified lines
137	static inline bool	137	static inline bool
138	nouveau_cli_work_ready(struct dma_fence *fence)	138	nouveau_cli_work_ready(struct dma_fence *fence)
139	{	139	{
140	if (!dma_fence_is_signaled(fence))	140	bool ret = true;
141	return false;	141
142	dma_fence_put(fence);	142	spin_lock_irq(fence->lock);
143	return true;	143	if (!dma_fence_is_signaled_locked(fence))
		144	ret = false;
		145	spin_unlock_irq(fence->lock);
		146
		147	if (ret == true)
		148	dma_fence_put(fence);
		149	return ret;
144	}	150	}
145		151
146	static void	152	static void