Commit c4caca38 authored Oct 22, 2018 by Lakshmi Narayana Kalavala

drm/msm/sde: avoid sde ctx unbalanced call in fence create failure



Fence create may fail while looking for unused fd or
during sync_file creation process. That leads to
dma_fence_put API called followed by fence->release() call.
The fence release API decrements the sde_ctx refcount
and it may lead to free the context unexpectedly.
This patch acquires the sde_ctx refcount before unused
fd and syn_file creation calls and balances the call
during failure case.

Change-Id: I56069a3b5472a4d80e0f451247b3ec6167bc91a6
Signed-off-by: Lakshmi Narayana Kalavala <lkalaval@codeaurora.org>

parent 1f3d4d45

drivers/gpu/drm/msm/sde/sde_fence.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -213,6 +213,7 @@ static int _sde_fence_create_fd(void *fence_ctx, uint32_t val)
		sde_fence->ctx->name, val);
		dma_fence_init(&sde_fence->base, &sde_fence_ops, &ctx->lock,
		ctx->context, val);
		kref_get(&ctx->kref);

		/* create fd */
		fd = get_unused_fd_flags(0);
		@@ -235,7 +236,6 @@ static int _sde_fence_create_fd(void *fence_ctx, uint32_t val)

		fd_install(fd, sync_file->file);
		sde_fence->fd = fd;
		kref_get(&ctx->kref);

		spin_lock(&ctx->list_lock);
		list_add_tail(&sde_fence->fence_list, &ctx->fence_list_head);