[PATCH 1/2] drm/ttm: never add BO that failed to validate to the LRU list

Nicolai Hähnle nhaehnle at gmail.com
Tue Feb 14 09:18:44 UTC 2017

From: Nicolai Hähnle <nicolai.haehnle at amd.com>

Fixes a potential race condition in amdgpu that looks as follows:

Task 1: attempt ttm_bo_init, but ttm_bo_validate fails
Task 1: add BO to global list anyway
Task 2: grabs hold of the BO, waits on its reservation lock
Task 1: releases its reference of the BO; never gives up the
        reservation lock

The patch "drm/amdgpu: fix a potential deadlock in
amdgpu_bo_create_restricted()" attempts to fix that by releasing
the reservation lock in amdgpu code; unfortunately, it introduces
a use-after-free when this race _doesn't_ happen.

This patch should fix the race properly by never adding the BO
to the global list in the first place.

Cc: Samuel Pitoiset <samuel.pitoiset at gmail.com>
Cc: zhoucm1 <david1.zhou at amd.com>
Signed-off-by: Nicolai Hähnle <nicolai.haehnle at amd.com>
 drivers/gpu/drm/ttm/ttm_bo.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 239a957..76bee42 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1215,18 +1215,20 @@ int ttm_bo_init(struct ttm_bo_device *bdev,
 	if (likely(!ret))
 		ret = ttm_bo_validate(bo, placement, interruptible, false);
-	if (!resv) {
+	if (!resv)
-	} else if (!(bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) {
+	if (unlikely(ret)) {
+		ttm_bo_unref(&bo);
+		return ret;
+	}
+	if (resv && !(bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) {
-	if (unlikely(ret))
-		ttm_bo_unref(&bo);
 	return ret;

More information about the amd-gfx mailing list