drm: Remove "protection" around drm_vma_offset_manager_destroy()

Using a spinlock to serialize the destroy function, within the destroy
function itself does not prevent the buggy driver from shooting
themselves in the foot - either way they still have a use-after-free
issue.

Reported-by: Jia-Ju Bai <[email protected]>
Signed-off-by: Chris Wilson <[email protected]>
Cc: Davidlohr Bueso <[email protected]>
Cc: Liviu Dudau <[email protected]>
Cc: Daniel Vetter <[email protected]>
Reviewed-by: Daniel Vetter <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]

diff --git a/drivers/gpu/drm/drm_vma_manager.c b/drivers/gpu/drm/drm_vma_manager.c
index a6b2fe36b025228cbcd0be546ce110e80bba7e39..c5d0d23583015fd94aafb9d9ee10b9ea263c5e7c 100644 (file)
--- a/drivers/gpu/drm/drm_vma_manager.c
+++ b/drivers/gpu/drm/drm_vma_manager.c
@@ -103,10 +103,7 @@ EXPORT_SYMBOL(drm_vma_offset_manager_init);
  */
 void drm_vma_offset_manager_destroy(struct drm_vma_offset_manager *mgr)
 {
-       /* take the lock to protect against buggy drivers */
-       write_lock(&mgr->vm_lock);
        drm_mm_takedown(&mgr->vm_addr_space_mm);
-       write_unlock(&mgr->vm_lock);
 }
 EXPORT_SYMBOL(drm_vma_offset_manager_destroy);