| Message ID | 1376999800-10151-1-git-send-email-chris@chris-wilson.co.uk (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Tue, Aug 20, 2013 at 12:56:40PM +0100, Chris Wilson wrote: > The execbuffer handle and exec_link were moved from the object into the > vma. As the vma may be unbound and destroyed whilst attempting to > reserve the execbuffer objects (either through a forced unbind to fix up > a misalignment or through an evict-everything call) we need to prevent > the free of the i915_vma itself. Otherwise not only is the list of > objects to reserve corrupt, but we continue to reference stale vma > entries. > > Fixes kernel crash with i-g-t/gem_evict_everything > > Reported-by: Dan Carpenter <dan.carpenter@oracle.com> > Bugzilla; https://bugs.freedesktop.org/show_bug.cgi?id=68298 > Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> > Cc: Ben Widawsky <ben@bwidawsk.net> Yeah, I think this is about as simple&clear as it gets. vmas used by execbuf simply have a bit a strange lifetime rule ... Queued for -next, thanks for the patch. Merged quickly since I want to keep the bisect fail window small, but I'll smash the test result from QA on top as soon as we have it. -Daniel
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index bf32b1e..33bbd69 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -4256,6 +4256,11 @@ void i915_gem_vma_destroy(struct i915_vma *vma) { WARN_ON(vma->node.allocated); list_del(&vma->vma_link); + + /* Keep the vma as a placeholder in the execbuffer reservation lists */ + if (!list_empty(&vma->exec_list)) + return; + kfree(vma); }
The execbuffer handle and exec_link were moved from the object into the vma. As the vma may be unbound and destroyed whilst attempting to reserve the execbuffer objects (either through a forced unbind to fix up a misalignment or through an evict-everything call) we need to prevent the free of the i915_vma itself. Otherwise not only is the list of objects to reserve corrupt, but we continue to reference stale vma entries. Fixes kernel crash with i-g-t/gem_evict_everything Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Bugzilla; https://bugs.freedesktop.org/show_bug.cgi?id=68298 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Ben Widawsky <ben@bwidawsk.net> --- drivers/gpu/drm/i915/i915_gem.c | 5 +++++ 1 file changed, 5 insertions(+)