<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - [BDW] use-after-free in gen8_ppgtt_alloc_page_directories"
href="https://bugs.freedesktop.org/show_bug.cgi?id=99684#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - [BDW] use-after-free in gen8_ppgtt_alloc_page_directories"
href="https://bugs.freedesktop.org/show_bug.cgi?id=99684">bug 99684</a>
from <span class="vcard"><a class="email" href="mailto:chris@chris-wilson.co.uk" title="Chris Wilson <chris@chris-wilson.co.uk>"> <span class="fn">Chris Wilson</span></a>
</span></b>
<pre>Shrinker doing unbind + clear_range vs bind + va_allocate is protected by
struct_mutex. But what if the shrinker is triggered by va_allocate or
insert-enties. Insert-entries should not be an issue, it should never allocate.
But there is a window of opportunity for the shrinker to run as we do allocate
and reap a level after we have already checked its presence.
Please see the patches on the list as to how we could fix this by moving the
accounting into the allocation phase - that will prevent us from reaping levels
we have already processed.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
<li>You are the assignee for the bug.</li>
<li>You are the QA Contact for the bug.</li>
</ul>
</body>
</html>