• Nick Hoath's avatar
    drm/i915: Fix a use after free, and unbalanced refcounting · b3a38998
    Nick Hoath authored
    When converting from implicitly tracked execlist queue items to ref counted
    requests, not all frees of requests were replaced with unrefs, and extraneous
    refs/unrefs of contexts were added.
    Correct the unbalanced refcount & replace the frees.
    Remove a noisy warning when hitting the request creation path.
    
    drm_i915_gem_request and intel_context are both kref reference counted
    structures. Upon allocation, drm_i915_gem_request's ref count should be
    bumped using kref_init. When a context is assigned to the request,
    the context's reference count should be bumped using i915_gem_context_reference.
    i915_gem_request_reference will reduce the context reference count when
    the request is freed.
    
    Problem introduced in
    commit 6d3d8274
    Author:     Nick Hoath <nicholas.hoath@intel.com>
    AuthorDate: Thu Jan 15 13:10:39 2015 +0000
    
         drm/i915: Subsume intel_ctx_submit_request in to drm_i915_gem_request
    
    v2: Added comments explaining how the ctx pointer and the request object should
    be ref-counted. Removed noisy warning.
    
    v3: Cleaned up the language used in the commit & the header
    description (Thanks David Gordon)
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=88652Signed-off-by: default avatarNick Hoath <nicholas.hoath@intel.com>
    Reviewed-by: default avatarThomas Daniel <thomas.daniel@intel.com>
    Reviewed-by: default avatarDaniel Vetter <daniel@ffwll.ch>
    Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
    b3a38998
i915_drv.h 100 KB