tree 34028a8bf96c51c09d30d9cb6d41361ab7ac0249
parent 8b0218beb5995a6d516da71ea22cbe763ff0c454
author Lucas Stach <l.stach@pengutronix.de> 1603910835 +0100
committer Marge Bot <eric+marge@anholt.net> 1604064464 +0000

etnaviv: drm: fix BO refcount race

There is a race where the BO refcount might drop to 0 before the
dmabuf/name import paths had a chance to grab a reference for a
BO found in the handle_table. The easiest solution is to keep the
refcount stable as long as the table_lock is held.

While a more involved scheme of rechecking the refcount before
actually destroying the BO might also work, the bo_del path isn't
called very often, so micro-optimizing a single mutex_lock seems
to be over-engineered, so go for the easy solution.

Cc: <mesa-stable@lists.freedesktop.org>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/7367>