[Intel-gfx] [PATCH 1/3] drm/i915: fix reference counting in i915_gem_create

[Chris Wilson]

On Wed, Jul 24, 2013 at 01:00:57PM +0200, Daniel Vetter wrote:
> This function is called without the dev->struct_mutex held, hence we
> need to use the _unlocked unreference variants.
> 
> As soon as the object is registered userspace can sneak in here with a
> gem_close ioctl call, so the object can (and with my new evil tests
> actually does) get the final unreference in this place. The lack of
> locking then results in hilarity and some good leakage.

So there is a small race for a second thread on the fd to guess the new
handle before the owner sees its. We should be able to push the transfer
of ownership into the handle_create() routine to close this race with
incurring any extra cost.
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre