diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2017-08-22 12:05:17 +0100 |
|---|---|---|
| committer | Rodrigo Vivi <rodrigo.vivi@intel.com> | 2017-08-30 12:17:22 -0700 |
| commit | fa3722f6496640b472bed1613e76da325211d757 (patch) | |
| tree | 4a138141823b33562cb02b1bb67b50ef5c0cbb88 /drivers/gpu/drm/i915/i915_gem.c | |
| parent | 18db229d30cd19c987885b79b90344ae061e870e (diff) | |
drm/i915: Ignore duplicate VMA stored within the per-object handle LUT
By using drm_gem_flink/drm_gem_open on an object using the same fd, it
is possible for a client to create multiple handles pointing to the same
object (tied to the same contexts and VMA), as exemplified by
igt::gem_handle_to_libdrm_bo(). Since this duplication has been possible
since forever, we cannot assume that the handle:(fpriv, object) is
unique and so must handle the multiple users of a single VMA.
v2: Added commentary noise.
Testcase: igt/gem_close
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=102355
Fixes: d1b48c1e7184 ("drm/i915: Replace execbuf vma ht with an idr")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20170822110517.22277-3-chris@chris-wilson.co.uk
Tested-by: Marta Lofstedt <marta.lofstedt@intel.com>
Reviewed-by: Michał Winiarski <michal.winiarski@intel.com>
(cherry-picked from commit 3ffff01749928ea5ffdae2cecad561898c3b0f71)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Diffstat (limited to 'drivers/gpu/drm/i915/i915_gem.c')
| -rw-r--r-- | drivers/gpu/drm/i915/i915_gem.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index a54a9631f59e..825d75c548b8 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -3262,7 +3262,13 @@ void i915_gem_close_object(struct drm_gem_object *gem, struct drm_file *file) vma = radix_tree_delete(&ctx->handles_vma, lut->handle); - if (!i915_vma_is_ggtt(vma)) + GEM_BUG_ON(vma->obj != obj); + + /* We allow the process to have multiple handles to the same + * vma, in the same fd namespace, by virtue of flink/open. + */ + GEM_BUG_ON(!vma->open_count); + if (!--vma->open_count && !i915_vma_is_ggtt(vma)) i915_vma_close(vma); list_del(&lut->obj_link); |