drm/i915/gem: Hold the obj->vma.lock while walking the vma.list (780ccb5a) · Commits · 戴 / test

Remember to take the lock before walking the obj->vma.list so that the nodes do not change beneath us! E.g., i915_gem_object_bump_inactive_ggtt:387 GEM_BUG_ON(vma->vm != &i915->ggtt.vm) Closes: https://gitlab.freedesktop.org/drm/intel/issues/691 Signed-off-by:

Chris Wilson <chris@chris-wilson.co.uk> Cc: Matthew Auld <matthew.auld@intel.com> Reviewed-by:

Matthew Auld <matthew.auld@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20191204164527.3872783-1-chris@chris-wilson.co.uk

drivers/gpu/drm/i915/gem/i915_gem_domain.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -379,8 +379,11 @@ static void i915_gem_object_bump_inactive_ggtt(struct drm_i915_gem_object *obj)
		struct i915_vma *vma;

		GEM_BUG_ON(!i915_gem_object_has_pinned_pages(obj));
		if (!atomic_read(&obj->bind_count))
		return;

		mutex_lock(&i915->ggtt.vm.mutex);
		spin_lock(&obj->vma.lock);
		for_each_ggtt_vma(vma, obj) {
		if (!drm_mm_node_allocated(&vma->node))
		continue;
		@@ -388,6 +391,7 @@ static void i915_gem_object_bump_inactive_ggtt(struct drm_i915_gem_object *obj)
		GEM_BUG_ON(vma->vm != &i915->ggtt.vm);
		list_move_tail(&vma->vm_link, &vma->vm->bound_list);
		}
		spin_unlock(&obj->vma.lock);
		mutex_unlock(&i915->ggtt.vm.mutex);

		if (i915_gem_object_is_shrinkable(obj)) {

Admin message