From bef454f22778c6a1393185ddcc5dbcdc7868d679 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Corentin=20No=C3=ABl?= Date: Fri, 27 Sep 2024 11:03:19 +0200 Subject: [PATCH] virgl: Avoid a race condition on handle removal MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We were unlocking the bo handles hash table right after removing the bo handle and afterward closing it. This leads to race conditions where the handle could have been re-acquired on another thread. As the kernel would return the same bo handle and do not reference count them, this leads to it being used after being closed. Signed-off-by: Corentin Noël Reviewed-by: Dmitry Osipenko cc: mesa-stable Part-of: --- src/gallium/winsys/virgl/drm/virgl_drm_winsys.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/gallium/winsys/virgl/drm/virgl_drm_winsys.c b/src/gallium/winsys/virgl/drm/virgl_drm_winsys.c index 03e33eb5508..692753b1373 100644 --- a/src/gallium/winsys/virgl/drm/virgl_drm_winsys.c +++ b/src/gallium/winsys/virgl/drm/virgl_drm_winsys.c @@ -93,13 +93,17 @@ static void virgl_hw_res_destroy(struct virgl_drm_winsys *qdws, if (res->flink_name) _mesa_hash_table_remove_key(qdws->bo_names, (void *)(uintptr_t)res->flink_name); - mtx_unlock(&qdws->bo_handles_mutex); if (res->ptr) os_munmap(res->ptr, res->size); memset(&args, 0, sizeof(args)); args.handle = res->bo_handle; drmIoctl(qdws->fd, DRM_IOCTL_GEM_CLOSE, &args); + /* We need to unlock the access to bo_handles after closing the GEM to + * avoid a race condition where another thread would not find the + * bo_handle leading to a call of DRM_IOCTL_GEM_OPEN which will return + * the same bo_handle as the one we are closing here. */ + mtx_unlock(&qdws->bo_handles_mutex); FREE(res); }