tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/gem: Acquire references on GEM handles for framebuffers

A GEM handle can be released while the GEM buffer object is attached
to a DRM framebuffer. This leads to the release of the dma-buf backing
the buffer object, if any. [1] Trying to use the framebuffer in further
mode-setting operations leads to a segmentation fault. Most easily
happens with driver that use shadow planes for vmap-ing the dma-buf
during a page flip. An example is shown below.

[ 156.791968] ------------[ cut here ]------------
[ 156.796830] WARNING: CPU: 2 PID: 2255 at drivers/dma-buf/dma-buf.c:1527 dma_buf_vmap+0x224/0x430
[...]
[ 156.942028] RIP: 0010:dma_buf_vmap+0x224/0x430
[ 157.043420] Call Trace:
[ 157.045898] <TASK>
[ 157.048030] ? show_trace_log_lvl+0x1af/0x2c0
[ 157.052436] ? show_trace_log_lvl+0x1af/0x2c0
[ 157.056836] ? show_trace_log_lvl+0x1af/0x2c0
[ 157.061253] ? drm_gem_shmem_vmap+0x74/0x710
[ 157.065567] ? dma_buf_vmap+0x224/0x430
[ 157.069446] ? __warn.cold+0x58/0xe4
[ 157.073061] ? dma_buf_vmap+0x224/0x430
[ 157.077111] ? report_bug+0x1dd/0x390
[ 157.080842] ? handle_bug+0x5e/0xa0
[ 157.084389] ? exc_invalid_op+0x14/0x50
[ 157.088291] ? asm_exc_invalid_op+0x16/0x20
[ 157.092548] ? dma_buf_vmap+0x224/0x430
[ 157.096663] ? dma_resv_get_singleton+0x6d/0x230
[ 157.101341] ? __pfx_dma_buf_vmap+0x10/0x10
[ 157.105588] ? __pfx_dma_resv_get_singleton+0x10/0x10
[ 157.110697] drm_gem_shmem_vmap+0x74/0x710
[ 157.114866] drm_gem_vmap+0xa9/0x1b0
[ 157.118763] drm_gem_vmap_unlocked+0x46/0xa0
[ 157.123086] drm_gem_fb_vmap+0xab/0x300
[ 157.126979] drm_atomic_helper_prepare_planes.part.0+0x487/0xb10
[ 157.133032] ? lockdep_init_map_type+0x19d/0x880
[ 157.137701] drm_atomic_helper_commit+0x13d/0x2e0
[ 157.142671] ? drm_atomic_nonblocking_commit+0xa0/0x180
[ 157.147988] drm_mode_atomic_ioctl+0x766/0xe40
[...]
[ 157.346424] ---[ end trace 0000000000000000 ]---

Acquiring GEM handles for the framebuffer's GEM buffer objects prevents
this from happening. The framebuffer's cleanup later puts the handle
references.

Commit 1a148af06000 ("drm/gem-shmem: Use dma_buf from GEM object
instance") triggers the segmentation fault easily by using the dma-buf
field more widely. The underlying issue with reference counting has
been present before.

v2:
- acquire the handle instead of the BO (Christian)
- fix comment style (Christian)
- drop the Fixes tag (Christian)
- rename err_ gotos
- add missing Link tag

Suggested-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://elixir.bootlin.com/linux/v6.15/source/drivers/gpu/drm/drm_gem.c#L241 # [1]
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Anusha Srivatsa <asrivats@redhat.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: "Christian König" <christian.koenig@amd.com>
Cc: linux-media@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: linaro-mm-sig@lists.linaro.org
Cc: <stable@vger.kernel.org>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/20250630084001.293053-1-tzimmermann@suse.de

Thomas Zimmermann 5307dce8 8af39ec5

+51 -11
+40 -4
drivers/gpu/drm/drm_gem.c
··· 212 212 } 213 213 EXPORT_SYMBOL(drm_gem_private_object_fini); 214 214 215 + static void drm_gem_object_handle_get(struct drm_gem_object *obj) 216 + { 217 + struct drm_device *dev = obj->dev; 218 + 219 + drm_WARN_ON(dev, !mutex_is_locked(&dev->object_name_lock)); 220 + 221 + if (obj->handle_count++ == 0) 222 + drm_gem_object_get(obj); 223 + } 224 + 225 + /** 226 + * drm_gem_object_handle_get_unlocked - acquire reference on user-space handles 227 + * @obj: GEM object 228 + * 229 + * Acquires a reference on the GEM buffer object's handle. Required 230 + * to keep the GEM object alive. Call drm_gem_object_handle_put_unlocked() 231 + * to release the reference. 232 + */ 233 + void drm_gem_object_handle_get_unlocked(struct drm_gem_object *obj) 234 + { 235 + struct drm_device *dev = obj->dev; 236 + 237 + guard(mutex)(&dev->object_name_lock); 238 + 239 + drm_WARN_ON(dev, !obj->handle_count); /* first ref taken in create-tail helper */ 240 + drm_gem_object_handle_get(obj); 241 + } 242 + EXPORT_SYMBOL(drm_gem_object_handle_get_unlocked); 243 + 215 244 /** 216 245 * drm_gem_object_handle_free - release resources bound to userspace handles 217 246 * @obj: GEM object to clean up. ··· 271 242 } 272 243 } 273 244 274 - static void 275 - drm_gem_object_handle_put_unlocked(struct drm_gem_object *obj) 245 + /** 246 + * drm_gem_object_handle_put_unlocked - releases reference on user-space handles 247 + * @obj: GEM object 248 + * 249 + * Releases a reference on the GEM buffer object's handle. Possibly releases 250 + * the GEM buffer object and associated dma-buf objects. 251 + */ 252 + void drm_gem_object_handle_put_unlocked(struct drm_gem_object *obj) 276 253 { 277 254 struct drm_device *dev = obj->dev; 278 255 bool final = false; ··· 303 268 if (final) 304 269 drm_gem_object_put(obj); 305 270 } 271 + EXPORT_SYMBOL(drm_gem_object_handle_put_unlocked); 306 272 307 273 /* 308 274 * Called at device or object close to release the file's ··· 425 389 int ret; 426 390 427 391 WARN_ON(!mutex_is_locked(&dev->object_name_lock)); 428 - if (obj->handle_count++ == 0) 429 - drm_gem_object_get(obj); 392 + 393 + drm_gem_object_handle_get(obj); 430 394 431 395 /* 432 396 * Get the user-visible handle using idr. Preload and perform
+9 -7
drivers/gpu/drm/drm_gem_framebuffer_helper.c
··· 99 99 unsigned int i; 100 100 101 101 for (i = 0; i < fb->format->num_planes; i++) 102 - drm_gem_object_put(fb->obj[i]); 102 + drm_gem_object_handle_put_unlocked(fb->obj[i]); 103 103 104 104 drm_framebuffer_cleanup(fb); 105 105 kfree(fb); ··· 182 182 if (!objs[i]) { 183 183 drm_dbg_kms(dev, "Failed to lookup GEM object\n"); 184 184 ret = -ENOENT; 185 - goto err_gem_object_put; 185 + goto err_gem_object_handle_put_unlocked; 186 186 } 187 + drm_gem_object_handle_get_unlocked(objs[i]); 188 + drm_gem_object_put(objs[i]); 187 189 188 190 min_size = (height - 1) * mode_cmd->pitches[i] 189 191 + drm_format_info_min_pitch(info, i, width) ··· 195 193 drm_dbg_kms(dev, 196 194 "GEM object size (%zu) smaller than minimum size (%u) for plane %d\n", 197 195 objs[i]->size, min_size, i); 198 - drm_gem_object_put(objs[i]); 196 + drm_gem_object_handle_put_unlocked(objs[i]); 199 197 ret = -EINVAL; 200 - goto err_gem_object_put; 198 + goto err_gem_object_handle_put_unlocked; 201 199 } 202 200 } 203 201 204 202 ret = drm_gem_fb_init(dev, fb, mode_cmd, objs, i, funcs); 205 203 if (ret) 206 - goto err_gem_object_put; 204 + goto err_gem_object_handle_put_unlocked; 207 205 208 206 return 0; 209 207 210 - err_gem_object_put: 208 + err_gem_object_handle_put_unlocked: 211 209 while (i > 0) { 212 210 --i; 213 - drm_gem_object_put(objs[i]); 211 + drm_gem_object_handle_put_unlocked(objs[i]); 214 212 } 215 213 return ret; 216 214 }
+2
drivers/gpu/drm/drm_internal.h
··· 161 161 162 162 /* drm_gem.c */ 163 163 int drm_gem_init(struct drm_device *dev); 164 + void drm_gem_object_handle_get_unlocked(struct drm_gem_object *obj); 165 + void drm_gem_object_handle_put_unlocked(struct drm_gem_object *obj); 164 166 int drm_gem_handle_create_tail(struct drm_file *file_priv, 165 167 struct drm_gem_object *obj, 166 168 u32 *handlep);