[src/trunk]: src/sys/external/bsd/drm2/dist/drm/nouveau Fix edge case of refe...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/75ae809d31b4
branches:  trunk
changeset: 364060:75ae809d31b4
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Thu Aug 23 01:10:36 2018 +0000

description:
Fix edge case of reference counting, oops.

PR kern/53441

XXX pullup-7
XXX pullup-8

diffstat:

 sys/external/bsd/drm2/dist/drm/nouveau/nouveau_fence.c |  12 +++++++-----
 1 files changed, 7 insertions(+), 5 deletions(-)

diffs (48 lines):

diff -r fe50965811ce -r 75ae809d31b4 sys/external/bsd/drm2/dist/drm/nouveau/nouveau_fence.c
--- a/sys/external/bsd/drm2/dist/drm/nouveau/nouveau_fence.c    Thu Aug 23 01:10:28 2018 +0000
+++ b/sys/external/bsd/drm2/dist/drm/nouveau/nouveau_fence.c    Thu Aug 23 01:10:36 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: nouveau_fence.c,v 1.8 2018/08/23 01:10:28 riastradh Exp $      */
+/*     $NetBSD: nouveau_fence.c,v 1.9 2018/08/23 01:10:36 riastradh Exp $      */
 
 /*
  * Copyright (C) 2007 Ben Skeggs.
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nouveau_fence.c,v 1.8 2018/08/23 01:10:28 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nouveau_fence.c,v 1.9 2018/08/23 01:10:36 riastradh Exp $");
 
 #include <sys/types.h>
 #include <sys/xcall.h>
@@ -136,7 +136,7 @@
 
        do {
                old = fctx->refcnt;
-               if (old == 0) {
+               if (old == 1) {
                        spin_lock(&fctx->lock);
                        if (atomic_dec_uint_nv(&fctx->refcnt) == 0)
                                DRM_SPIN_WAKEUP_ALL(&fctx->waitqueue,
@@ -216,8 +216,10 @@
        /* Wait for nouveau_fence_channel_acquire to complete on all CPUs.  */
        xc_wait(xc_broadcast(0, nouveau_fence_context_del_xc, NULL, NULL));
 
-       /* Wait for any references to drain.  */
+       /* Release our reference and wait for any others to drain.  */
        spin_lock(&fctx->lock);
+       KASSERT(fctx->refcnt > 0);
+       atomic_dec_uint(&fctx->refcnt);
        DRM_SPIN_WAIT_NOINTR_UNTIL(ret, &fctx->waitqueue, &fctx->lock,
            fctx->refcnt == 0);
        BUG_ON(ret);
@@ -247,7 +249,7 @@
        INIT_LIST_HEAD(&fctx->done);
        spin_lock_init(&fctx->lock);
        DRM_INIT_WAITQUEUE(&fctx->waitqueue, "nvfnchan");
-       fctx->refcnt = 0;
+       fctx->refcnt = 1;
 }
 
 /*