| Message ID | 20230510141932.413348-2-thomas.hellstrom@linux.intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/xe: Fix unprotected rebind_list accesses | expand |
On Wed, May 10, 2023 at 04:19:31PM +0200, Thomas Hellström wrote: > the vma::rebind_link is protected by the vm's resv, but we was > modifying it without. Fix this by use the vma::userptr_link instead > for the tmp_evict list. The vma::userptr_link is protected by the > vm lock. > > Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> > --- > drivers/gpu/drm/xe/xe_vm.c | 14 +++++++------- > 1 file changed, 7 insertions(+), 7 deletions(-) > > diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c > index 0a4becdf4675..5f93d78c2e58 100644 > --- a/drivers/gpu/drm/xe/xe_vm.c > +++ b/drivers/gpu/drm/xe/xe_vm.c > @@ -764,8 +764,7 @@ int xe_vm_userptr_pin(struct xe_vm *vm) > if (err < 0) > goto out_err; > > - list_del_init(&vma->userptr_link); > - list_move_tail(&vma->rebind_link, &tmp_evict); > + list_move_tail(&vma->userptr_link, &tmp_evict); > } > > /* Take lock and move to rebind_list for rebinding. */ > @@ -773,16 +772,17 @@ int xe_vm_userptr_pin(struct xe_vm *vm) > if (err) > goto out_err; > > - list_splice_tail(&tmp_evict, &vm->rebind_list); > + list_for_each_entry_safe(vma, next, &tmp_evict, userptr_link) { > + list_del_init(&vma->userptr_link); > + list_move_tail(&vma->rebind_link, &vm->rebind_list); > + } > + > dma_resv_unlock(&vm->resv); > > return 0; > > out_err: > - list_for_each_entry_safe(vma, next, &tmp_evict, rebind_link) { > - list_del_init(&vma->rebind_link); > - list_add_tail(&vma->userptr_link, &vm->userptr.repin_list); > - } > + list_splice_tail(&tmp_evict, &vm->userptr.repin_list); > > return err; > } > -- > 2.39.2 >
diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c index 0a4becdf4675..5f93d78c2e58 100644 --- a/drivers/gpu/drm/xe/xe_vm.c +++ b/drivers/gpu/drm/xe/xe_vm.c @@ -764,8 +764,7 @@ int xe_vm_userptr_pin(struct xe_vm *vm) if (err < 0) goto out_err; - list_del_init(&vma->userptr_link); - list_move_tail(&vma->rebind_link, &tmp_evict); + list_move_tail(&vma->userptr_link, &tmp_evict); } /* Take lock and move to rebind_list for rebinding. */ @@ -773,16 +772,17 @@ int xe_vm_userptr_pin(struct xe_vm *vm) if (err) goto out_err; - list_splice_tail(&tmp_evict, &vm->rebind_list); + list_for_each_entry_safe(vma, next, &tmp_evict, userptr_link) { + list_del_init(&vma->userptr_link); + list_move_tail(&vma->rebind_link, &vm->rebind_list); + } + dma_resv_unlock(&vm->resv); return 0; out_err: - list_for_each_entry_safe(vma, next, &tmp_evict, rebind_link) { - list_del_init(&vma->rebind_link); - list_add_tail(&vma->userptr_link, &vm->userptr.repin_list); - } + list_splice_tail(&tmp_evict, &vm->userptr.repin_list); return err; }
the vma::rebind_link is protected by the vm's resv, but we was modifying it without. Fix this by use the vma::userptr_link instead for the tmp_evict list. The vma::userptr_link is protected by the vm lock. Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> --- drivers/gpu/drm/xe/xe_vm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)