[PATCH] drm/ttm: once more fix ttm_bo_bulk_move_lru_tail

[Christian König]

Am 14.09.2018 um 11:22 schrieb Michel Dänzer:
> On 2018-09-14 10:22 a.m., Huang Rui wrote:
>> On Thu, Sep 13, 2018 at 07:32:24PM +0800, Christian König wrote:
>>> Am 13.09.2018 um 10:31 schrieb Huang Rui:
>>>> On Wed, Sep 12, 2018 at 09:23:55PM +0200, Christian König wrote:
>>>>> While cutting the lists we sometimes accidentally added a list_head from
>>>>> the stack to the LRUs, effectively corrupting the list.
>>>>>
>>>>> Remove the list cutting and use explicit list manipulation instead.
>>>> This patch actually fixes the corruption bug. Was it a defect of
>>>> list_cut_position or list_splice handlers?
>>> We somehow did something illegal with list_cut_position. I haven't
>>> narrowed it down till the end, but we ended up with list_heads from the
>>> stack to the lru.
>> I am confused, in theory, even we do any manipulation with list helper, it
>> should not trigger the list corruption. The usage of those helpers should
>> ensure the list operation safely...
> There's nothing the helpers can do about being passed in pointers to
> stack memory. It's a bug in the code using the helpers.

Actually I'm not 100% sure of that. To me it looks like we hit a corner 
case list_cut_position doesn't support.

Or we indeed had a logic error in how we called it, anyway the explicit 
implementation only uses 6 assignments and so is much easier to handle.

Christian.