git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 933bb75072aac04a8d2c6eb8b870c89e5eebcc84 Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Mon, 2 Nov 2020 16:19:31 +0000
   4 Subject: drm/i915: Hold onto an explicit ref to i915_vma_work.pinned
   5
   6 From: Chris Wilson <chris@chris-wilson.co.uk>
   7
   8 [ Upstream commit 537457a979a02a410b555fab289dcb28b588f33b ]
   9
  10 Since __vma_release is run by a kworker after the fence has been
  11 signaled, it is no longer protected by the active reference on the vma,
  12 and so the alias of vw->pinned to vma->obj is also not protected by a
  13 reference on the object. Add an explicit reference for vw->pinned so it
  14 will always be safe.
  15
  16 Found by inspection.
  17
  18 Fixes: 54d7195f8c64 ("drm/i915: Unpin vma->obj on early error")
  19 Reported-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
  20 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
  21 Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
  22 Cc: <stable@vger.kernel.org> # v5.6+
  23 Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
  24 Link: https://patchwork.freedesktop.org/patch/msgid/20201102161931.30031-1-chris@chris-wilson.co.uk
  25 (cherry picked from commit bc73e5d33048b7ab5f12b11b5d923700467a8e1d)
  26 Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
  27 Signed-off-by: Sasha Levin <sashal@kernel.org>
  28 ---
  29  drivers/gpu/drm/i915/i915_vma.c | 6 ++++--
  30  1 file changed, 4 insertions(+), 2 deletions(-)
  31
  32 diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
  33 index bc64f773dcdb4..034d0a8d24c8c 100644
  34 --- a/drivers/gpu/drm/i915/i915_vma.c
  35 +++ b/drivers/gpu/drm/i915/i915_vma.c
  36 @@ -315,8 +315,10 @@ static void __vma_release(struct dma_fence_work *work)
  37  {
  38         struct i915_vma_work *vw = container_of(work, typeof(*vw), base);
  39
  40 -       if (vw->pinned)
  41 +       if (vw->pinned) {
  42                 __i915_gem_object_unpin_pages(vw->pinned);
  43 +               i915_gem_object_put(vw->pinned);
  44 +       }
  45  }
  46
  47  static const struct dma_fence_work_ops bind_ops = {
  48 @@ -430,7 +432,7 @@ int i915_vma_bind(struct i915_vma *vma,
  49
  50                 if (vma->obj) {
  51                         __i915_gem_object_pin_pages(vma->obj);
  52 -                       work->pinned = vma->obj;
  53 +                       work->pinned = i915_gem_object_get(vma->obj);
  54                 }
  55         } else {
  56                 ret = vma->ops->bind_vma(vma->vm, vma, cache_level, bind_flags);
  57 --
  58 2.27.0
  59