Commit 309a5482 authored Aug 25, 2017 by Jason Ekstrand Committed by Dave Airlie Aug 29, 2017

drm/syncobj: Add a race-free drm_syncobj_fence_get helper (v2)



The atomic exchange operation in drm_syncobj_replace_fence is sufficient
for the case where it races with itself.  However, if you have a race
between a replace_fence and dma_fence_get(syncobj->fence), you may end
up with the entire replace_fence happening between the point in time
where the one thread gets the syncobj->fence pointer and when it calls
dma_fence_get() on it.  If this happens, then the reference may be
dropped before we get a chance to get a new one.  The new helper uses
dma_fence_get_rcu_safe to get rid of the race.

This is also needed because it allows us to do a bit more than just get
a reference in drm_syncobj_fence_get should we wish to do so.

v2:
 - RCU isn't that scary
 - Call rcu_read_lock/unlock
 - Don't rename fence to _fence
 - Make the helper static inline

Signed-off-by: Jason Ekstrand <jason@jlekstrand.net>
Acked-by: Christian König <christian.koenig@amd.com> (v1)
Signed-off-by: Dave Airlie <airlied@redhat.com>

parent afaf5923

drivers/gpu/drm/drm_syncobj.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -105,7 +105,7 @@ int drm_syncobj_find_fence(struct drm_file *file_private,
		if (!syncobj)
		return -ENOENT;

		*fence = dma_fence_get(syncobj->fence);
		*fence = drm_syncobj_fence_get(syncobj);
		if (!*fence) {
		ret = -EINVAL;
		}

include/drm/drm_syncobj.h

+12 −0

Original line number	Diff line number	Diff line
		@@ -77,6 +77,18 @@ drm_syncobj_put(struct drm_syncobj *obj)
		kref_put(&obj->refcount, drm_syncobj_free);
		}

		static inline struct dma_fence *
		drm_syncobj_fence_get(struct drm_syncobj *syncobj)
		{
		struct dma_fence *fence;

		rcu_read_lock();
		fence = dma_fence_get_rcu_safe(&syncobj->fence);
		rcu_read_unlock();

		return fence;
		}

		struct drm_syncobj drm_syncobj_find(struct drm_file file_private,
		u32 handle);
		void drm_syncobj_replace_fence(struct drm_syncobj *syncobj,

Admin message