[Intel-gfx] [PATCH] drm/i915: Fix unsafe vma iteration in i915_drop_caches

[Daniel Vetter]

On Wed, Sep 03, 2014 at 07:23:37PM +0100, Chris Wilson wrote:
> When unbinding, there is a possibility that we drop the active reference
> on the object, thereby freeing it. If that happens, we may destroy the
> vm link as well as the object and vma. So iterate carefully.
> 
> Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

Queued for -next, thanks for the patch.
-Daniel

> ---
>  drivers/gpu/drm/i915/i915_debugfs.c | 17 +++++++++++------
>  1 file changed, 11 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
> index 4bac550fe829..fba36ea263f0 100644
> --- a/drivers/gpu/drm/i915/i915_debugfs.c
> +++ b/drivers/gpu/drm/i915/i915_debugfs.c
> @@ -3894,8 +3894,6 @@ i915_drop_caches_set(void *data, u64 val)
>  	struct drm_device *dev = data;
>  	struct drm_i915_private *dev_priv = dev->dev_private;
>  	struct drm_i915_gem_object *obj, *next;
> -	struct i915_address_space *vm;
> -	struct i915_vma *vma, *x;
>  	int ret;
>  
>  	DRM_DEBUG("Dropping caches: 0x%08llx\n", val);
> @@ -3916,16 +3914,23 @@ i915_drop_caches_set(void *data, u64 val)
>  		i915_gem_retire_requests(dev);
>  
>  	if (val & DROP_BOUND) {
> -		list_for_each_entry(vm, &dev_priv->vm_list, global_link) {
> -			list_for_each_entry_safe(vma, x, &vm->inactive_list,
> -						 mm_list) {
> +		list_for_each_entry_safe(obj, next, &dev_priv->mm.bound_list,
> +					 global_list) {
> +			struct i915_vma *vma, *v;
> +
> +			ret = 0;
> +			drm_gem_object_reference(&obj->base);
> +			list_for_each_entry_safe(vma, v, &obj->vma_list, vma_link) {
>  				if (vma->pin_count)
>  					continue;
>  
>  				ret = i915_vma_unbind(vma);
>  				if (ret)
> -					goto unlock;
> +					break;
>  			}
> +			drm_gem_object_unreference(&obj->base);
> +			if (ret)
> +				goto unlock;
>  		}
>  	}
>  
> -- 
> 2.1.0
> 
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx

-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch