[PATCH v3 2/3] drm/i915/gvt: Read dmabuf->file only while valid

[Matt Evans]

After 4ab59c3c638c6 ("dma-buf: Move dma_buf_release() from fops to
dentry_ops"), dmabuf->file can close prior to the .release callback
being invoked.

intel_vgpu_get_dmabuf() exports the dmabuf, then dma_buf_fd()
effectively transfers its file's reference to the fd.  A debug print
dereferences dmabuf->file after the dma_buf_fd(); however, the fd
could be closed by another thread, making dmabuf->file stale.

Read file_count() while the reference to dmabuf->file is still held,
for later debug printing.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 4ab59c3c638c6 ("dma-buf: Move dma_buf_release() from fops to dentry_ops")
Signed-off-by: Matt Evans <matt@xxxxxxxxxx>
---
 drivers/gpu/drm/i915/gvt/dmabuf.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
index 8a1d6c5636c2..b6f50f2b912d 100644
--- a/drivers/gpu/drm/i915/gvt/dmabuf.c
+++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
@@ -503,6 +503,7 @@ int intel_vgpu_get_dmabuf(struct intel_vgpu *vgpu, unsigned int dmabuf_id)
 	struct drm_device *dev = &vgpu->gvt->gt->i915->drm;
 	struct intel_vgpu_dmabuf_obj *dmabuf_obj;
 	struct drm_i915_gem_object *obj;
+	unsigned long db_fcount;
 	struct dma_buf *dmabuf;
 	int dmabuf_fd;
 	int ret = 0;
@@ -531,6 +532,7 @@ int intel_vgpu_get_dmabuf(struct intel_vgpu *vgpu, unsigned int dmabuf_id)
 		ret = PTR_ERR(dmabuf);
 		goto out_free_gem;
 	}
+	db_fcount = file_count(dmabuf->file);
 
 	ret = dma_buf_fd(dmabuf, DRM_CLOEXEC | DRM_RDWR);
 	if (ret < 0) {
@@ -552,8 +554,7 @@ int intel_vgpu_get_dmabuf(struct intel_vgpu *vgpu, unsigned int dmabuf_id)
 		    "        file count: %ld, GEM ref: %d\n",
 		    vgpu->id, dmabuf_obj->dmabuf_id,
 		    kref_read(&dmabuf_obj->kref),
-		    dmabuf_fd,
-		    file_count(dmabuf->file),
+		    dmabuf_fd, db_fcount,
 		    kref_read(&obj->base.refcount));
 
 	i915_gem_object_put(obj);
-- 
2.47.3