From patchwork Thu May 26 23:50:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Osipenko X-Patchwork-Id: 12862900 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ED73BC4332F for ; Thu, 26 May 2022 23:54:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349569AbiEZXy0 (ORCPT ); Thu, 26 May 2022 19:54:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52552 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349577AbiEZXyX (ORCPT ); Thu, 26 May 2022 19:54:23 -0400 Received: from bhuna.collabora.co.uk (bhuna.collabora.co.uk [46.235.227.227]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7859CE8BBA; Thu, 26 May 2022 16:54:22 -0700 (PDT) Received: from [127.0.0.1] (localhost [127.0.0.1]) (Authenticated sender: dmitry.osipenko) with ESMTPSA id 7FE781F40878 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1653609261; bh=mb8OzuWYSbm/AwBqD3mtEmj7ojjTOwTQHEjozWJ6AEk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PhWK+IykYUYDFR1HcPNf0jNTY7TZY0Ln8bRitBt0kB04+hQst9WEWAPvJrsPNbW/Z zIQsLj3s8FkbFS4J6AAh9FGS2SwW1x8ICQ0O/cvyoPbSY9PlksO1KkHleCnmYzw7Z6 Ps8r6ksbvWvvZMDMZbofS5W+UPPdelQLtTYTEoz/XHigCcMJC4tMpERsMpTB6zdAic 8fb8WgUWkUOccDal1GJu2bE6uZh0Ptg5/jLFxQaJtKw60Ga4PMr48eHgPMc+RrV70m KD8BH07+7/LJbMYplSdVI7Vrv32FhCvxsaGBiQiOPaDk68WNK5CFK34N2/2GNSCthp uuNX5S9HTuVQQ== From: Dmitry Osipenko To: David Airlie , Gerd Hoffmann , Gurchetan Singh , Chia-I Wu , Daniel Vetter , Daniel Almeida , Gert Wollny , Gustavo Padovan , Daniel Stone , Tomeu Vizoso , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , Rob Herring , Steven Price , Alyssa Rosenzweig , Rob Clark , Emil Velikov , Robin Murphy , Qiang Yu , Sumit Semwal , =?utf-8?q?Christian_K=C3=B6nig?= , "Pan, Xinhui" , Thierry Reding , Tomasz Figa , Marek Szyprowski , Mauro Carvalho Chehab , Alex Deucher , Jani Nikula , Joonas Lahtinen , Rodrigo Vivi , Tvrtko Ursulin Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, virtualization@lists.linux-foundation.org, Dmitry Osipenko , Dmitry Osipenko , linux-tegra@vger.kernel.org, linux-media@vger.kernel.org, linaro-mm-sig@lists.linaro.org, amd-gfx@lists.freedesktop.org, intel-gfx@lists.freedesktop.org, kernel@collabora.com Subject: [PATCH v6 04/22] drm/panfrost: Fix shrinker list corruption by madvise IOCTL Date: Fri, 27 May 2022 02:50:22 +0300 Message-Id: <20220526235040.678984-5-dmitry.osipenko@collabora.com> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220526235040.678984-1-dmitry.osipenko@collabora.com> References: <20220526235040.678984-1-dmitry.osipenko@collabora.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org Calling madvise IOCTL twice on BO causes memory shrinker list corruption and crashes kernel because BO is already on the list and it's added to the list again, while BO should be removed from from the list before it's re-added. Fix it. Cc: stable@vger.kernel.org Fixes: 013b65101315 ("drm/panfrost: Add madvise and shrinker support") Signed-off-by: Dmitry Osipenko Acked-by: Alyssa Rosenzweig Reviewed-by: Steven Price --- drivers/gpu/drm/panfrost/panfrost_drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/panfrost/panfrost_drv.c b/drivers/gpu/drm/panfrost/panfrost_drv.c index 087e69b98d06..b1e6d238674f 100644 --- a/drivers/gpu/drm/panfrost/panfrost_drv.c +++ b/drivers/gpu/drm/panfrost/panfrost_drv.c @@ -433,8 +433,8 @@ static int panfrost_ioctl_madvise(struct drm_device *dev, void *data, if (args->retained) { if (args->madv == PANFROST_MADV_DONTNEED) - list_add_tail(&bo->base.madv_list, - &pfdev->shrinker_list); + list_move_tail(&bo->base.madv_list, + &pfdev->shrinker_list); else if (args->madv == PANFROST_MADV_WILLNEED) list_del_init(&bo->base.madv_list); }