xen/gntdev: Do not destroy context while dma-bufs are in use
authorOleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Thu, 14 Feb 2019 14:23:20 +0000 (16:23 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 5 Apr 2019 20:33:06 +0000 (22:33 +0200)
commit7273c2b1e79c042532960bcf55feaec33a288e41
tree1456f46c32113d5cb859a5f86ccd8c54824eb099
parente9cd7f5437640d4af2800c9db8283ec487332c43
xen/gntdev: Do not destroy context while dma-bufs are in use

[ Upstream commit fa13e665e02874c0a5f4d06d6967ae34a6cb3d6a ]

If there are exported DMA buffers which are still in use and
grant device is closed by either normal user-space close or by
a signal this leads to the grant device context to be destroyed,
thus making it not possible to correctly destroy those exported
buffers when they are returned back to gntdev and makes the module
crash:

[  339.617540] [<ffff00000854c0d8>] dmabuf_exp_ops_release+0x40/0xa8
[  339.617560] [<ffff00000867a6e8>] dma_buf_release+0x60/0x190
[  339.617577] [<ffff0000082211f0>] __fput+0x88/0x1d0
[  339.617589] [<ffff000008221394>] ____fput+0xc/0x18
[  339.617607] [<ffff0000080ed4e4>] task_work_run+0x9c/0xc0
[  339.617622] [<ffff000008089714>] do_notify_resume+0xfc/0x108

Fix this by referencing gntdev on each DMA buffer export and
unreferencing on buffer release.

Signed-off-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Reviewed-by: Boris Ostrovsky@oracle.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/xen/gntdev-dmabuf.c
drivers/xen/gntdev-dmabuf.h
drivers/xen/gntdev.c