[Intel-gfx] [PATCH] drm/i915: Clear breadcrumb node when cancelling signaling

[Joonas Lahtinen]

On Wed, 2017-11-15 at 12:14 +0000, Chris Wilson wrote:
> When we call intel_engine_cancel_signaling() to stop reporting whether
> or not a request is completed via an asynchronous signal, we remove that
> request from the breadcrumb wait queue. However, we may be concurrently
> processing that request in the signaler itself, the actual operations on
> the request itself are serialised but we do not actually clear the
> waiter after removing it from the tree allowing both parties to attempt
> to do so and corrupting the rbtree. (Elsewhere removing from the
> breadcrumb wait queue could only be done on behalf of i915_wait_request,
> so this race could not happen).
> 
> Reported-by: "He, Bo" <bo.he at intel.com>
> Fixes: 9eb143bbec7d ("drm/i915: Allow a request to be cancelled")
> Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
> Cc: "He, Bo" <bo.he at intel.com>
> Cc: Tvrtko Ursulin <tvrtko.ursulin at intel.com>
> Cc: Michał Winiarski <michal.winiarski at intel.com>
> Cc: Joonas Lahtinen <joonas.lahtinen at linux.intel.com>

Reviewed-by: Joonas Lahtinen <joonas.lahtinen at linux.intel.com>

Regards, Joonas
-- 
Joonas Lahtinen
Open Source Technology Center
Intel Corporation