Commit 5ddd6582 authored by Chris Wilson's avatar Chris Wilson

drm: Remove "protection" around drm_vma_offset_manager_destroy()

Using a spinlock to serialize the destroy function, within the destroy
function itself does not prevent the buggy driver from shooting
themselves in the foot - either way they still have a use-after-free
issue.
Reported-by: default avatarJia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Liviu Dudau <Liviu.Dudau@arm.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20180903093155.3825-1-chris@chris-wilson.co.uk
parent a9734d8e
...@@ -103,10 +103,7 @@ EXPORT_SYMBOL(drm_vma_offset_manager_init); ...@@ -103,10 +103,7 @@ EXPORT_SYMBOL(drm_vma_offset_manager_init);
*/ */
void drm_vma_offset_manager_destroy(struct drm_vma_offset_manager *mgr) void drm_vma_offset_manager_destroy(struct drm_vma_offset_manager *mgr)
{ {
/* take the lock to protect against buggy drivers */
write_lock(&mgr->vm_lock);
drm_mm_takedown(&mgr->vm_addr_space_mm); drm_mm_takedown(&mgr->vm_addr_space_mm);
write_unlock(&mgr->vm_lock);
} }
EXPORT_SYMBOL(drm_vma_offset_manager_destroy); EXPORT_SYMBOL(drm_vma_offset_manager_destroy);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment