[PATCH 5/5] dma-buf: nuke reservation_object seq number

[Chris Wilson]

Quoting Christian König (2019-08-05 16:45:54)
> @@ -214,16 +214,16 @@ static __poll_t dma_buf_poll(struct file *file, poll_table *poll)
>                 return 0;
>  
>  retry:
> -       seq = read_seqcount_begin(&resv->seq);
>         rcu_read_lock();
>  
> +       fence_excl = rcu_dereference(resv->fence_excl);
>         fobj = rcu_dereference(resv->fence);
>         if (fobj)
>                 shared_count = fobj->shared_count;
>         else
>                 shared_count = 0;
> -       fence_excl = rcu_dereference(resv->fence_excl);
> -       if (read_seqcount_retry(&resv->seq, seq)) {
> +
> +       if (rcu_dereference(resv->fence_excl) != fence_excl) {

If I remember my rules correctly, rcu_dereference is a
read-data-depends, which only means that a read through the pointer
returned by rcu_dereference() is after the retrieval of that pointer.
Nothing orders the retrieval of fence_excl vs shared_count (different
pointers), so I think the last line should be:

smp_rmb();
if (rcu_access_pointer(resv->fence_excl) != fence_excl)
-Chris