[PATCH] drm/amdgpu: set bulk_moveable to false when a per VM is released

[Huang Rui]

On Wed, Sep 05, 2018 at 05:08:26PM +0200, Christian König wrote:
> Otherwise we might run into a use after free during bulk move.
> 
> Signed-off-by: Christian König <christian.koenig at amd.com>

Is this patch able to fix the KASAN?
[   66.143009] ==================================================================
[   66.143254] BUG: KASAN: use-after-free in ttm_bo_bulk_move_lru_tail+0x2b/0x100 [ttm]
[   66.143263] Read of size 8 at addr ffff8801f193d550 by task gnome-shel:cs0/4194

Tom, may we have your tested-by?

Reviewed-by: Huang Rui <ray.huang at amd.com>

> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
> index ea5e277ae038..ed1e6abda391 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
> @@ -2513,8 +2513,12 @@ void amdgpu_vm_bo_rmv(struct amdgpu_device *adev,
>  		      struct amdgpu_bo_va *bo_va)
>  {
>  	struct amdgpu_bo_va_mapping *mapping, *next;
> +	struct amdgpu_bo *bo = bo_va->base.bo;
>  	struct amdgpu_vm *vm = bo_va->base.vm;
>  
> +	if (bo && bo->tbo.resv == vm->root.base.bo->tbo.resv)
> +		vm->bulk_moveable = false;
> +
>  	list_del(&bo_va->base.bo_list);
>  
>  	spin_lock(&vm->invalidated_lock);
> -- 
> 2.17.1
> 
> _______________________________________________
> amd-gfx mailing list
> amd-gfx at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/amd-gfx