After 4ab59c3c638c6 ("dma-buf: Move dma_buf_release() from fops to dentry_ops"), dmabuf->file can close prior to the .release callback being invoked.
intel_vgpu_get_dmabuf() exports the dmabuf, then dma_buf_fd() effectively transfers its file's reference to the fd. A debug print dereferences dmabuf->file after the dma_buf_fd(); however, the fd could be closed by another thread, making dmabuf->file stale.
Read file_count() while the reference to dmabuf->file is still held, for later debug printing.
Cc: stable@vger.kernel.org Fixes: 4ab59c3c638c6 ("dma-buf: Move dma_buf_release() from fops to dentry_ops") Signed-off-by: Matt Evans matt@ozlabs.org --- drivers/gpu/drm/i915/gvt/dmabuf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c index 8a1d6c5636c2..b6f50f2b912d 100644 --- a/drivers/gpu/drm/i915/gvt/dmabuf.c +++ b/drivers/gpu/drm/i915/gvt/dmabuf.c @@ -503,6 +503,7 @@ int intel_vgpu_get_dmabuf(struct intel_vgpu *vgpu, unsigned int dmabuf_id) struct drm_device *dev = &vgpu->gvt->gt->i915->drm; struct intel_vgpu_dmabuf_obj *dmabuf_obj; struct drm_i915_gem_object *obj; + unsigned long db_fcount; struct dma_buf *dmabuf; int dmabuf_fd; int ret = 0; @@ -531,6 +532,7 @@ int intel_vgpu_get_dmabuf(struct intel_vgpu *vgpu, unsigned int dmabuf_id) ret = PTR_ERR(dmabuf); goto out_free_gem; } + db_fcount = file_count(dmabuf->file);
ret = dma_buf_fd(dmabuf, DRM_CLOEXEC | DRM_RDWR); if (ret < 0) { @@ -552,8 +554,7 @@ int intel_vgpu_get_dmabuf(struct intel_vgpu *vgpu, unsigned int dmabuf_id) " file count: %ld, GEM ref: %d\n", vgpu->id, dmabuf_obj->dmabuf_id, kref_read(&dmabuf_obj->kref), - dmabuf_fd, - file_count(dmabuf->file), + dmabuf_fd, db_fcount, kref_read(&obj->base.refcount));
i915_gem_object_put(obj);