iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

drm/ttm: fix deref of bo->ttm without holding the lock v2

Browse Source 
We need to grab the resv lock first before doing that check.

v2 (chk): simplify the change for -fixes

Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Huang Rui <ray.huang@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210528130041.1683-1-christian.koenig@amd.com
This commit is contained in:
Christian König 2021-05-28 14:34:38 +02:00
parent 9bf3797796
commit 2d2ddb589d
2 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/gpu/drm/ttm/ttm_bo.c
View File

@ -1172,7 +1172,10 @@ int ttm_bo_swapout(struct ttm_buffer_object *bo, struct ttm_operation_ctx *ctx,
if (!ttm_bo_evict_swapout_allowable(bo, ctx, &locked, NULL)) if (!ttm_bo_evict_swapout_allowable(bo, ctx, &locked, NULL))
return -EBUSY; return -EBUSY;
if (!ttm_bo_get_unless_zero(bo)) { if (!bo->ttm || !ttm_tt_is_populated(bo->ttm) ||
bo->ttm->page_flags & TTM_PAGE_FLAG_SG ||
bo->ttm->page_flags & TTM_PAGE_FLAG_SWAPPED ||
!ttm_bo_get_unless_zero(bo)) {
if (locked) if (locked)
dma_resv_unlock(bo->base.resv); dma_resv_unlock(bo->base.resv);
return -EBUSY; return -EBUSY;

8
drivers/gpu/drm/ttm/ttm_device.c
View File

@ -143,14 +143,8 @@ int ttm_device_swapout(struct ttm_device *bdev, struct ttm_operation_ctx *ctx,
for (j = 0; j < TTM_MAX_BO_PRIORITY; ++j) { for (j = 0; j < TTM_MAX_BO_PRIORITY; ++j) {
list_for_each_entry(bo, &man->lru[j], lru) { list_for_each_entry(bo, &man->lru[j], lru) {
uint32_t num_pages; uint32_t num_pages = PFN_UP(bo->base.size);
if (!bo->ttm || !ttm_tt_is_populated(bo->ttm) ||
bo->ttm->page_flags & TTM_PAGE_FLAG_SG ||
bo->ttm->page_flags & TTM_PAGE_FLAG_SWAPPED)
continue;
num_pages = bo->ttm->num_pages;
ret = ttm_bo_swapout(bo, ctx, gfp_flags); ret = ttm_bo_swapout(bo, ctx, gfp_flags);
/* ttm_bo_swapout has dropped the lru_lock */ /* ttm_bo_swapout has dropped the lru_lock */
if (!ret) if (!ret)