Commit 537457a9 authored Nov 02, 2020 by Chris Wilson Committed by Rodrigo Vivi Nov 03, 2020

drm/i915: Hold onto an explicit ref to i915_vma_work.pinned



Since __vma_release is run by a kworker after the fence has been
signaled, it is no longer protected by the active reference on the vma,
and so the alias of vw->pinned to vma->obj is also not protected by a
reference on the object. Add an explicit reference for vw->pinned so it
will always be safe.

Found by inspection.

Fixes: 54d7195f ("drm/i915: Unpin vma->obj on early error")
Reported-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: <stable@vger.kernel.org> # v5.6+
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201102161931.30031-1-chris@chris-wilson.co.uk


(cherry picked from commit bc73e5d3)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

parent e67d01d8

drivers/gpu/drm/i915/i915_vma.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -314,8 +314,10 @@ static void __vma_release(struct dma_fence_work *work)
		{
		struct i915_vma_work vw = container_of(work, typeof(vw), base);

		if (vw->pinned)
		if (vw->pinned) {
		__i915_gem_object_unpin_pages(vw->pinned);
		i915_gem_object_put(vw->pinned);
		}

		i915_vm_free_pt_stash(vw->vm, &vw->stash);
		i915_vm_put(vw->vm);
		@@ -431,7 +433,7 @@ int i915_vma_bind(struct i915_vma *vma,

		if (vma->obj) {
		__i915_gem_object_pin_pages(vma->obj);
		work->pinned = vma->obj;
		work->pinned = i915_gem_object_get(vma->obj);
		}
		} else {
		vma->ops->bind_vma(vma->vm, NULL, vma, cache_level, bind_flags);

Admin message