git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From cf5e3413337309050c05e13dcebe85b7194a21e5 Mon Sep 17 00:00:00 2001
   2 From: Thomas Hellstrom <thellstrom@vmware.com>
   3 Date: Thu, 30 Jan 2014 10:58:19 +0100
   4 Subject: drm/vmwgfx: Fix regression caused by "drm/ttm: make ttm reservation calls behave like reservation calls"
   5
   6 From: Thomas Hellstrom <thellstrom@vmware.com>
   7
   8 commit cf5e3413337309050c05e13dcebe85b7194a21e5 upstream.
   9
  10 The call to ttm_eu_backoff_reservation() as part of an error path would cause
  11 a lock imbalance if the reservation ticket was not initialized. This error is
  12 easily triggered from user-space by submitting a bogus command stream.
  13
  14 Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
  15 Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
  16 Cc: Maarten Lankhorst <maarten.lankhorst@canonical.com>
  17 Cc: Jerome Glisse <jglisse@redhat.com>
  18 Cc: Dave Airlie <airlied@redhat.com>
  19 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  20
  21 ---
  22  drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c |    9 +++++----
  23  1 file changed, 5 insertions(+), 4 deletions(-)
  24
  25 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
  26 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
  27 @@ -1483,11 +1483,11 @@ int vmw_execbuf_process(struct drm_file
  28         ret = vmw_cmd_check_all(dev_priv, sw_context, kernel_commands,
  29                                 command_size);
  30         if (unlikely(ret != 0))
  31 -               goto out_err;
  32 +               goto out_err_nores;
  33
  34         ret = vmw_resources_reserve(sw_context);
  35         if (unlikely(ret != 0))
  36 -               goto out_err;
  37 +               goto out_err_nores;
  38
  39         ret = ttm_eu_reserve_buffers(&ticket, &sw_context->validate_nodes);
  40         if (unlikely(ret != 0))
  41 @@ -1569,10 +1569,11 @@ int vmw_execbuf_process(struct drm_file
  42         return 0;
  43
  44  out_err:
  45 -       vmw_resource_relocations_free(&sw_context->res_relocations);
  46 -       vmw_free_relocations(sw_context);
  47         ttm_eu_backoff_reservation(&ticket, &sw_context->validate_nodes);
  48 +out_err_nores:
  49         vmw_resource_list_unreserve(&sw_context->resource_list, true);
  50 +       vmw_resource_relocations_free(&sw_context->res_relocations);
  51 +       vmw_free_relocations(sw_context);
  52         vmw_clear_validations(sw_context);
  53         if (unlikely(dev_priv->pinned_bo != NULL &&
  54                      !dev_priv->query_cid_valid))