freedreno/drm: Submit should hold ref to device

Prevent the device from being deleted prior to submit cleanup.
Otherwise submit cleanup can try to reference an already free'd
device (and use already closed rendernode fd, etc).

Fixes: ("e6b2785811c2 freedreno/drm/virtio: Use userspace IOVA allocation")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27343>
This commit is contained in:
Rob Clark 2024-01-29 09:43:55 -08:00 committed by Marge Bot
parent fe8c2dd43a
commit d558cb664a
2 changed files with 3 additions and 0 deletions

View file

@ -401,6 +401,7 @@ struct fd_submit_funcs {
struct fd_submit {
int32_t refcnt;
struct fd_pipe *pipe;
struct fd_device *dev;
const struct fd_submit_funcs *funcs;
struct fd_ringbuffer *primary;

View file

@ -36,6 +36,7 @@ fd_submit_new(struct fd_pipe *pipe)
struct fd_submit *submit = pipe->funcs->submit_new(pipe);
submit->refcnt = 1;
submit->pipe = fd_pipe_ref(pipe);
submit->dev = fd_device_ref(pipe->dev);
return submit;
}
@ -49,6 +50,7 @@ fd_submit_del(struct fd_submit *submit)
fd_ringbuffer_del(submit->primary);
fd_pipe_del(submit->pipe);
fd_device_del(submit->dev);
submit->funcs->destroy(submit);
}