Commit 1ee57d4d authored by Noralf Trønnes's avatar Noralf Trønnes

drm: Fix drm_release() and device unplug

If userspace has open fd(s) when drm_dev_unplug() is run, it will result
in drm_dev_unregister() being called twice. First in drm_dev_unplug() and
then later in drm_release() through the call to drm_put_dev().

Since userspace already holds a ref on drm_device through the drm_minor,
it's not necessary to add extra ref counting based on no open file
handles. Instead just drm_dev_put() unconditionally in drm_dev_unplug().

We now have this:
- Userpace holds a ref on drm_device as long as there's open fd(s)
- The driver holds a ref on drm_device as long as it's bound to the
  struct device

When both sides are done with drm_device, it is released.
Signed-off-by: default avatarNoralf Trønnes <noralf@tronnes.org>
Reviewed-by: default avatarOleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: default avatarSean Paul <sean@poorly.run>
Link: https://patchwork.freedesktop.org/patch/msgid/20190208140103.28919-2-noralf@tronnes.org
parent 1fdafbd0
...@@ -376,11 +376,7 @@ void drm_dev_unplug(struct drm_device *dev) ...@@ -376,11 +376,7 @@ void drm_dev_unplug(struct drm_device *dev)
synchronize_srcu(&drm_unplug_srcu); synchronize_srcu(&drm_unplug_srcu);
drm_dev_unregister(dev); drm_dev_unregister(dev);
mutex_lock(&drm_global_mutex);
if (dev->open_count == 0)
drm_dev_put(dev); drm_dev_put(dev);
mutex_unlock(&drm_global_mutex);
} }
EXPORT_SYMBOL(drm_dev_unplug); EXPORT_SYMBOL(drm_dev_unplug);
......
...@@ -479,11 +479,9 @@ int drm_release(struct inode *inode, struct file *filp) ...@@ -479,11 +479,9 @@ int drm_release(struct inode *inode, struct file *filp)
drm_file_free(file_priv); drm_file_free(file_priv);
if (!--dev->open_count) { if (!--dev->open_count)
drm_lastclose(dev); drm_lastclose(dev);
if (drm_dev_is_unplugged(dev))
drm_put_dev(dev);
}
mutex_unlock(&drm_global_mutex); mutex_unlock(&drm_global_mutex);
drm_minor_release(minor); drm_minor_release(minor);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment