Commit 5934ce99 authored by David Riley's avatar David Riley Committed by Gerd Hoffmann

drm/virtio: Fix cache entry creation race.

virtio_gpu_cmd_get_capset would check for the existence of an entry
under lock.  If it was not found, it would unlock and call
virtio_gpu_cmd_get_capset to create a new entry.  The new entry would
be added it to the list without checking if it was added by another
task during the period where the lock was not held resulting in
duplicate entries.

Compounding this issue, virtio_gpu_cmd_capset_cb would stop iterating
after find the first matching entry.  Multiple callbacks would modify
the first entry, but any subsequent entries and their associated waiters
would eventually timeout since they don't become valid, also wasting
memory along the way.
Signed-off-by: default avatarDavid Riley <davidriley@chromium.org>
Link: http://patchwork.freedesktop.org/patch/msgid/20190605234423.11348-3-davidriley@chromium.orgSigned-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 676a905b
...@@ -694,8 +694,11 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev, ...@@ -694,8 +694,11 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
struct virtio_gpu_vbuffer *vbuf; struct virtio_gpu_vbuffer *vbuf;
int max_size; int max_size;
struct virtio_gpu_drv_cap_cache *cache_ent; struct virtio_gpu_drv_cap_cache *cache_ent;
struct virtio_gpu_drv_cap_cache *search_ent;
void *resp_buf; void *resp_buf;
*cache_p = NULL;
if (idx >= vgdev->num_capsets) if (idx >= vgdev->num_capsets)
return -EINVAL; return -EINVAL;
...@@ -726,9 +729,26 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev, ...@@ -726,9 +729,26 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
atomic_set(&cache_ent->is_valid, 0); atomic_set(&cache_ent->is_valid, 0);
cache_ent->size = max_size; cache_ent->size = max_size;
spin_lock(&vgdev->display_info_lock); spin_lock(&vgdev->display_info_lock);
/* Search while under lock in case it was added by another task. */
list_for_each_entry(search_ent, &vgdev->cap_cache, head) {
if (search_ent->id == vgdev->capsets[idx].id &&
search_ent->version == version) {
*cache_p = search_ent;
break;
}
}
if (!*cache_p)
list_add_tail(&cache_ent->head, &vgdev->cap_cache); list_add_tail(&cache_ent->head, &vgdev->cap_cache);
spin_unlock(&vgdev->display_info_lock); spin_unlock(&vgdev->display_info_lock);
if (*cache_p) {
/* Entry was found, so free everything that was just created. */
kfree(resp_buf);
kfree(cache_ent->caps_cache);
kfree(cache_ent);
return 0;
}
cmd_p = virtio_gpu_alloc_cmd_resp cmd_p = virtio_gpu_alloc_cmd_resp
(vgdev, &virtio_gpu_cmd_capset_cb, &vbuf, sizeof(*cmd_p), (vgdev, &virtio_gpu_cmd_capset_cb, &vbuf, sizeof(*cmd_p),
sizeof(struct virtio_gpu_resp_capset) + max_size, sizeof(struct virtio_gpu_resp_capset) + max_size,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment