Re: dma-buf and ->dev refcount fun

2014-03-25 Thread Daniel Vetter
On Tue, Mar 25, 2014 at 10:40:45AM +0100, David Herrmann wrote: > Hi > > On Tue, Mar 25, 2014 at 9:01 AM, Daniel Vetter wrote: > > Besides the issue at hand though I think drivers need to make sure > > that the device they use for attaching does outlive the dma-buf. Which > > for real hotpluggin

Re: dma-buf and ->dev refcount fun

2014-03-25 Thread Dave Airlie
On Tue, Mar 25, 2014 at 7:40 PM, David Herrmann wrote: > Hi > > On Tue, Mar 25, 2014 at 9:01 AM, Daniel Vetter wrote: >> Besides the issue at hand though I think drivers need to make sure >> that the device they use for attaching does outlive the dma-buf. Which >> for real hotpluggin probably mea

Re: dma-buf and ->dev refcount fun

2014-03-25 Thread David Herrmann
Hi On Tue, Mar 25, 2014 at 9:01 AM, Daniel Vetter wrote: > Besides the issue at hand though I think drivers need to make sure > that the device they use for attaching does outlive the dma-buf. Which > for real hotpluggin probably means that drivers need to drop all > attachment on unplug (the dma

Re: dma-buf and ->dev refcount fun

2014-03-25 Thread Thomas Hellstrom
On 03/25/2014 09:01 AM, Daniel Vetter wrote: > On Tue, Mar 25, 2014 at 4:53 AM, Dave Airlie wrote: >> So I've got a reproducable oops with udl sharing from i915, >> >> start X, connect UDL, randr it into position, rip out udl device, kill X, >> >> we get an oops when dma_unmap_sg in i915_gem_unmap

Re: dma-buf and ->dev refcount fun

2014-03-25 Thread Daniel Vetter
On Tue, Mar 25, 2014 at 4:53 AM, Dave Airlie wrote: > So I've got a reproducable oops with udl sharing from i915, > > start X, connect UDL, randr it into position, rip out udl device, kill X, > > we get an oops when dma_unmap_sg in i915_gem_unmap_dma_buf gets > called, attachment->dev is pointing

dma-buf and ->dev refcount fun

2014-03-24 Thread Dave Airlie
So I've got a reproducable oops with udl sharing from i915, start X, connect UDL, randr it into position, rip out udl device, kill X, we get an oops when dma_unmap_sg in i915_gem_unmap_dma_buf gets called, attachment->dev is pointing to a freed structure, now the drm + udl driver points dev->dev