linux-kernel - Re: [PATCH v6 6/6] drm/i915/gvt: Adding interface so user space can get the dma-buf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1496417038.16895.7.camel@redhat.com>
Date:   Fri, 02 Jun 2017 17:23:58 +0200
From:   Gerd Hoffmann <kraxel@...hat.com>
To:     Alex Williamson <alex.williamson@...hat.com>,
        "Chen, Xiaoguang" <xiaoguang.chen@...el.com>
Cc:     "chris@...is-wilson.co.uk" <chris@...is-wilson.co.uk>,
        "intel-gfx@...ts.freedesktop.org" <intel-gfx@...ts.freedesktop.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "zhenyuw@...ux.intel.com" <zhenyuw@...ux.intel.com>,
        "Lv, Zhiyuan" <zhiyuan.lv@...el.com>,
        "intel-gvt-dev@...ts.freedesktop.org" 
        <intel-gvt-dev@...ts.freedesktop.org>,
        "Wang, Zhi A" <zhi.a.wang@...el.com>,
        "Tian, Kevin" <kevin.tian@...el.com>
Subject: Re: [PATCH v6 6/6] drm/i915/gvt: Adding interface so user space can
 get the dma-buf

  Hi,

> > When i915's dma-buf's release() callback is called it will try to
> > free the gem object associated with the dma-buf if its ref count is
> > 0. But in our case the ref count is 1 so no free callback is called
> > so we can not release allocations there.

Why the ref count is one?  Who holds a reference and why?
Maybe it should be the other way around, i.e. the dmabuf holds a
reference on the vgpu instance backing it, i.e. you can't delete the
vgpu while dma-bufs exist?

> We cannot simply say that the user isn't allowed to release them in
> that order.

Yep, not going to fly.  Can happen even unintentionally because we can
pass around dmabufs to other processes.  Example: qemu passes dmabuf to
spice-client, then qemu crashes.  mgmt fd is closed before dmabuf fd
then.  The kernel must be able to handle that.

cheers,
  Gerd