| Message ID | 20210325152740.82633-1-christian.koenig@amd.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/ttm: fix invalid NULL deref | expand |
On 25/03/2021 15:27, Christian König wrote: > The BO might be NULL in this function, use the bdev directly. > > Signed-off-by: Christian König <christian.koenig@amd.com> > Reported-by: Colin Ian King <colin.king@canonical.com> > Fixes: a1f091f8ef2b ("drm/ttm: switch to per device LRU lock") > --- > drivers/gpu/drm/ttm/ttm_bo.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c > index 2d2ac532987e..6ab7b66ce36d 100644 > --- a/drivers/gpu/drm/ttm/ttm_bo.c > +++ b/drivers/gpu/drm/ttm/ttm_bo.c > @@ -625,7 +625,7 @@ int ttm_mem_evict_first(struct ttm_device *bdev, > unsigned i; > int ret; > > - spin_lock(&bo->bdev->lru_lock); > + spin_lock(&bdev->lru_lock); > for (i = 0; i < TTM_MAX_BO_PRIORITY; ++i) { > list_for_each_entry(bo, &man->lru[i], lru) { > bool busy; > @@ -662,7 +662,7 @@ int ttm_mem_evict_first(struct ttm_device *bdev, > if (!bo) { > if (busy_bo && !ttm_bo_get_unless_zero(busy_bo)) > busy_bo = NULL; > - spin_unlock(&bo->bdev->lru_lock); > + spin_unlock(&bdev->lru_lock); > ret = ttm_mem_evict_wait_busy(busy_bo, ctx, ticket); > if (busy_bo) > ttm_bo_put(busy_bo); > @@ -676,7 +676,7 @@ int ttm_mem_evict_first(struct ttm_device *bdev, > return ret; > } > > - spin_unlock(&bo->bdev->lru_lock); > + spin_unlock(&bdev->lru_lock); > > ret = ttm_bo_evict(bo, ctx); > if (locked) > Looks good to me. Thanks. Reviewed-by: Colin Ian King <colin.king@canonical.com>
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c index 2d2ac532987e..6ab7b66ce36d 100644 --- a/drivers/gpu/drm/ttm/ttm_bo.c +++ b/drivers/gpu/drm/ttm/ttm_bo.c @@ -625,7 +625,7 @@ int ttm_mem_evict_first(struct ttm_device *bdev, unsigned i; int ret; - spin_lock(&bo->bdev->lru_lock); + spin_lock(&bdev->lru_lock); for (i = 0; i < TTM_MAX_BO_PRIORITY; ++i) { list_for_each_entry(bo, &man->lru[i], lru) { bool busy; @@ -662,7 +662,7 @@ int ttm_mem_evict_first(struct ttm_device *bdev, if (!bo) { if (busy_bo && !ttm_bo_get_unless_zero(busy_bo)) busy_bo = NULL; - spin_unlock(&bo->bdev->lru_lock); + spin_unlock(&bdev->lru_lock); ret = ttm_mem_evict_wait_busy(busy_bo, ctx, ticket); if (busy_bo) ttm_bo_put(busy_bo); @@ -676,7 +676,7 @@ int ttm_mem_evict_first(struct ttm_device *bdev, return ret; } - spin_unlock(&bo->bdev->lru_lock); + spin_unlock(&bdev->lru_lock); ret = ttm_bo_evict(bo, ctx); if (locked)
The BO might be NULL in this function, use the bdev directly. Signed-off-by: Christian König <christian.koenig@amd.com> Reported-by: Colin Ian King <colin.king@canonical.com> Fixes: a1f091f8ef2b ("drm/ttm: switch to per device LRU lock") --- drivers/gpu/drm/ttm/ttm_bo.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)