| Message ID | 20201102161931.30031-1-chris@chris-wilson.co.uk (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/i915: Hold onto an explicit ref to i915_vma_work.pinned | expand |
On 02/11/2020 16:19, Chris Wilson wrote: > Since __vma_release is run by a kworker after the fence has been > signaled, it is no longer protected by the active reference on the vma, > and so the alias of vw->pinned to vma->obj is also not protected by a > reference on the object. Add an explicit reference for vw->pinned so it > will always be safe. > > Found by inspection. > > Fixes: 54d7195f8c64 ("drm/i915: Unpin vma->obj on early error") > Reported-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> > Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> > Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> > Cc: <stable@vger.kernel.org> # v5.6+ > --- > drivers/gpu/drm/i915/i915_vma.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c > index ffb5287e055a..caa9b041616b 100644 > --- a/drivers/gpu/drm/i915/i915_vma.c > +++ b/drivers/gpu/drm/i915/i915_vma.c > @@ -314,8 +314,10 @@ static void __vma_release(struct dma_fence_work *work) > { > struct i915_vma_work *vw = container_of(work, typeof(*vw), base); > > - if (vw->pinned) > + if (vw->pinned) { > __i915_gem_object_unpin_pages(vw->pinned); > + i915_gem_object_put(vw->pinned); > + } > > i915_vm_free_pt_stash(vw->vm, &vw->stash); > i915_vm_put(vw->vm); > @@ -431,7 +433,7 @@ int i915_vma_bind(struct i915_vma *vma, > > if (vma->obj) { > __i915_gem_object_pin_pages(vma->obj); > - work->pinned = vma->obj; > + work->pinned = i915_gem_object_get(vma->obj); > } > } else { > vma->ops->bind_vma(vma->vm, NULL, vma, cache_level, bind_flags); > Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Regards, Tvrtko
diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c index ffb5287e055a..caa9b041616b 100644 --- a/drivers/gpu/drm/i915/i915_vma.c +++ b/drivers/gpu/drm/i915/i915_vma.c @@ -314,8 +314,10 @@ static void __vma_release(struct dma_fence_work *work) { struct i915_vma_work *vw = container_of(work, typeof(*vw), base); - if (vw->pinned) + if (vw->pinned) { __i915_gem_object_unpin_pages(vw->pinned); + i915_gem_object_put(vw->pinned); + } i915_vm_free_pt_stash(vw->vm, &vw->stash); i915_vm_put(vw->vm); @@ -431,7 +433,7 @@ int i915_vma_bind(struct i915_vma *vma, if (vma->obj) { __i915_gem_object_pin_pages(vma->obj); - work->pinned = vma->obj; + work->pinned = i915_gem_object_get(vma->obj); } } else { vma->ops->bind_vma(vma->vm, NULL, vma, cache_level, bind_flags);
Since __vma_release is run by a kworker after the fence has been signaled, it is no longer protected by the active reference on the vma, and so the alias of vw->pinned to vma->obj is also not protected by a reference on the object. Add an explicit reference for vw->pinned so it will always be safe. Found by inspection. Fixes: 54d7195f8c64 ("drm/i915: Unpin vma->obj on early error") Reported-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: <stable@vger.kernel.org> # v5.6+ --- drivers/gpu/drm/i915/i915_vma.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)