[PATCH 46/48] staging: etnaviv: rewrite submit interface to use copy from user

[Lucas Stach]

Am Montag, den 26.10.2015, 20:48 +0000 schrieb Russell King - ARM Linux:
> On Fri, Sep 25, 2015 at 01:57:58PM +0200, Lucas Stach wrote:
> > +void etnaviv_gpu_cmdbuf_free(struct etnaviv_cmdbuf *cmdbuf)
> > +{
> > +	dma_free_writecombine(cmdbuf->gpu->dev, cmdbuf->size,
> > +			      cmdbuf->vaddr, cmdbuf->paddr);
> > +	kfree(cmdbuf);
> > +}
> ...
> > @@ -885,6 +914,14 @@ static void retire_worker(struct work_struct *work)
> > +	list_for_each_entry_safe(cmdbuf, tmp, &gpu->active_cmd_list,
> > +				 gpu_active_list) {
> > +		if (fence_after_eq(fence, cmdbuf->fence)) {
> > +			etnaviv_gpu_cmdbuf_free(cmdbuf);
> > +			list_del(&cmdbuf->gpu_active_list);
> 
> I mentioned that I'd left one of my machines on a soak test - with vlc
> running with a video clip, but in pause mode.  vlc continues writing
> frames to the etnaviv Xv GPU backend, thereby exercising these code
> paths.  After about 39 hours, the above provoked the oops below, which
> is a use-after-free bug.  Fix on its way to my git branch once builds
> and reboots are complete.
> 
Urgh, thanks for fixing that.

Regards,
Lucas

-- 
Pengutronix e.K.             | Lucas Stach                 |
Industrial Linux Solutions   | http://www.pengutronix.de/  |