similar to: [PATCH 1/1] drm/qxl: add mutex_lock/mutex_unlock to ensure the order in which resources are released.

Hi, > > The only way I see for this to happen is that the guest is preempted > > between qxl_push_{cursor,command}_ring_release() and > > qxl_release_fence_buffer_objects() calls. The host can complete the qxl > > command then, signal the guest, and the IRQ handler calls > > qxl_release_free_list() before qxl_release_fence_buffer_objects() runs. > > We think

On Wed, Apr 29, 2020 at 12:01:24PM +0300, Vasily Averin wrote: > qxl_release should not be accesses after qxl_push_*_ring_release() calls: > userspace driver can process submitted command quickly, move qxl_release > into release_ring, generate interrupt and trigger garbage collector. > > It can lead to crashes in qxl driver or trigger memory corruption > in some kmalloc-192 slab

Final driver! \o/ This is not a proper dma_fence because the hardware may never signal anything, so don't use dma-buf with qxl, ever. Signed-off-by: Maarten Lankhorst <maarten.lankhorst at canonical.com> --- drivers/gpu/drm/qxl/Makefile | 2 drivers/gpu/drm/qxl/qxl_cmd.c | 5 - drivers/gpu/drm/qxl/qxl_debugfs.c | 12 ++- drivers/gpu/drm/qxl/qxl_drv.h | 22 ++---

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c index 013b938986c7..f30460782f05 100644 --- a/drivers/gpu/drm/qxl/qxl_debugfs.c +++

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c index 013b938986c7..f30460782f05 100644 ---

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c index bdb5ac0987ab..94439212a5c5 100644 ---

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c index bdb5ac0987ab..94439212a5c5 100644 ---

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c index bdb5ac0987ab..94439212a5c5 100644 ---

Move final cleanups to qxl_drm_release() callback. Add drm_atomic_helper_shutdown() call to qxl_pci_remove(). Reorder calls in qxl_device_fini(). Cleaning up gem & ttm might trigger qxl commands, so we should do that before releaseing command rings. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.c | 21 ++++++++++++++-------

Reorder calls in qxl_device_fini(). Cleaning up gem & ttm might trigger qxl commands, so we should do that before releaseing command rings. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_kms.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c index

Move final cleanups to qxl_drm_release() callback. Add drm_atomic_helper_shutdown() call to qxl_pci_remove(). Reorder calls in qxl_device_fini(). Cleaning up gem & ttm might trigger qxl commands, so we should do that before releaseing command rings. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.c | 21 ++++++++++++++-------

> > Move final cleanups to qxl_drm_release() callback. Can you explain in the commit why this is better or preferable? > Add drm_atomic_helper_shutdown() call to qxl_pci_remove(). I suppose this is to replace the former manual cleanup calls, which were moved to qxl_drm_release, I think this could be added in the commit message ("why"), I don't see much value in

Lovely diffstat, thanks to the new generic fbdev emulation. drm/qxl/Makefile | 2 drm/qxl/qxl_draw.c | 232 ---------------------------------------- drm/qxl/qxl_drv.h | 21 --- drm/qxl/qxl_fb.c | 300 ----------------------------------------------------- Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 21 ---

qxl expects that list_first_entry(release->bos) returns the first element qxl added to the list. ttm_eu_reserve_buffers() may reorder the list though. Add a release_bo field to struct qxl_release and use that instead. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 1 + drivers/gpu/drm/qxl/qxl_cmd.c | 6 ++----

If qxl_device_init fails on creating resources and does not report it, then qxl module will catch null pointer exception on remove, or on probe's error path. The patch adds error path with resources release into qxl_device_init. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Anton Vasilyev <vasilyev at ispras.ru> --- drivers/gpu/drm/qxl/qxl_kms.c | 80

Drop pointless indirection, remove the mem_slots array and index variables, drop dynamic allocation. Store memslots in qxl_device instead. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 15 +++++---- drivers/gpu/drm/qxl/qxl_kms.c | 72 +++++++++++++++++-------------------------- 2 files changed, 36 insertions(+), 51 deletions(-) diff --git

In ocfs2_remove_btree_range, when calling ocfs2_lock_refcount_tree and ocfs2_prepare_refcount_change_for_del failed, it goes to out and then tries to call mutex_unlock without mutex_lock before. And when calling ocfs2_reserve_blocks_for_rec_trunc failed, it should free ref_tree before return. Signed-off-by: Joseph Qi <joseph.qi at huawei.com> --- fs/ocfs2/alloc.c | 8 ++++---- 1 file

This reorders the list to keep track of what buffers are reserved, so previous members are always unreserved. This gets rid of some bookkeeping that's no longer needed, while simplifying the code some. Signed-off-by: Maarten Lankhorst <maarten.lankhorst at canonical.com> --- drivers/gpu/drm/qxl/qxl_release.c | 1 drivers/gpu/drm/ttm/ttm_execbuf_util.c | 142

No users are left, kill it off! :D Conversion to the reservation api is next on the list, after that the functionality can be restored with rcu. Signed-off-by: Maarten Lankhorst <maarten.lankhorst at canonical.com> --- drivers/gpu/drm/nouveau/nouveau_bo.c | 25 +++------- drivers/gpu/drm/nouveau/nouveau_display.c | 6 -- drivers/gpu/drm/nouveau/nouveau_gem.c | 16 +-----

On Thu, Jun 13, 2019 at 05:11:21PM -0700, Ralph Campbell wrote: > In nouveau_dmem_pages_alloc(), the drm->dmem->mutex is unlocked before > calling nouveau_dmem_chunk_alloc(). > Reacquire the lock before continuing to the next page. > > Signed-off-by: Ralph Campbell <rcampbell at nvidia.com> > --- > > I found this while testing Jason Gunthorpe's hmm tree