From d558cb664a6833fa5ea09e8c4b5bd79d438aa8cd Mon Sep 17 00:00:00 2001 From: Rob Clark Date: Mon, 29 Jan 2024 09:43:55 -0800 Subject: [PATCH] freedreno/drm: Submit should hold ref to device Prevent the device from being deleted prior to submit cleanup. Otherwise submit cleanup can try to reference an already free'd device (and use already closed rendernode fd, etc). Fixes: ("e6b2785811c2 freedreno/drm/virtio: Use userspace IOVA allocation") Signed-off-by: Rob Clark Part-of: --- src/freedreno/drm/freedreno_priv.h | 1 + src/freedreno/drm/freedreno_ringbuffer.c | 2 ++ 2 files changed, 3 insertions(+) diff --git a/src/freedreno/drm/freedreno_priv.h b/src/freedreno/drm/freedreno_priv.h index 95bf0478330..6de8915b91e 100644 --- a/src/freedreno/drm/freedreno_priv.h +++ b/src/freedreno/drm/freedreno_priv.h @@ -401,6 +401,7 @@ struct fd_submit_funcs { struct fd_submit { int32_t refcnt; struct fd_pipe *pipe; + struct fd_device *dev; const struct fd_submit_funcs *funcs; struct fd_ringbuffer *primary; diff --git a/src/freedreno/drm/freedreno_ringbuffer.c b/src/freedreno/drm/freedreno_ringbuffer.c index 48cd84ad0bf..310fa3f3dc3 100644 --- a/src/freedreno/drm/freedreno_ringbuffer.c +++ b/src/freedreno/drm/freedreno_ringbuffer.c @@ -36,6 +36,7 @@ fd_submit_new(struct fd_pipe *pipe) struct fd_submit *submit = pipe->funcs->submit_new(pipe); submit->refcnt = 1; submit->pipe = fd_pipe_ref(pipe); + submit->dev = fd_device_ref(pipe->dev); return submit; } @@ -49,6 +50,7 @@ fd_submit_del(struct fd_submit *submit) fd_ringbuffer_del(submit->primary); fd_pipe_del(submit->pipe); + fd_device_del(submit->dev); submit->funcs->destroy(submit); }