[Intel-gfx] [PATCH] drm/i915: Hold mutex across i915_gem_release

[Daniel Vetter]

On Wed, Dec 04, 2013 at 02:52:06PM +0000, Chris Wilson wrote:
> Inorder to serialise the closing of the file descriptor and its
> subsequent release of client requests with i915_gem_free_request(), we
> need to hold the struct_mutex in i915_gem_release(). Failing to do so
> has the potential to trigger an OOPS, later with a use-after-free.
> 
> Testcase: igt/gem_close_race
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=70874
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=71029
> Reported-by: Eric Anholt <eric at anholt.net>
> Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
> Cc: stable at vger.kernel.org

Picked up for -fixes, thanks for the patch.
-Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch