[Intel-gfx] [PATCH] drm/i915: Hold onto an explicit ref to i915_vma_work.pinned

[Tvrtko Ursulin]

On 02/11/2020 16:19, Chris Wilson wrote:
> Since __vma_release is run by a kworker after the fence has been
> signaled, it is no longer protected by the active reference on the vma,
> and so the alias of vw->pinned to vma->obj is also not protected by a
> reference on the object. Add an explicit reference for vw->pinned so it
> will always be safe.
> 
> Found by inspection.
> 
> Fixes: 54d7195f8c64 ("drm/i915: Unpin vma->obj on early error")
> Reported-by: Tvrtko Ursulin <tvrtko.ursulin at intel.com>
> Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
> Cc: Tvrtko Ursulin <tvrtko.ursulin at intel.com>
> Cc: <stable at vger.kernel.org> # v5.6+
> ---
>   drivers/gpu/drm/i915/i915_vma.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
> index ffb5287e055a..caa9b041616b 100644
> --- a/drivers/gpu/drm/i915/i915_vma.c
> +++ b/drivers/gpu/drm/i915/i915_vma.c
> @@ -314,8 +314,10 @@ static void __vma_release(struct dma_fence_work *work)
>   {
>   	struct i915_vma_work *vw = container_of(work, typeof(*vw), base);
>   
> -	if (vw->pinned)
> +	if (vw->pinned) {
>   		__i915_gem_object_unpin_pages(vw->pinned);
> +		i915_gem_object_put(vw->pinned);
> +	}
>   
>   	i915_vm_free_pt_stash(vw->vm, &vw->stash);
>   	i915_vm_put(vw->vm);
> @@ -431,7 +433,7 @@ int i915_vma_bind(struct i915_vma *vma,
>   
>   		if (vma->obj) {
>   			__i915_gem_object_pin_pages(vma->obj);
> -			work->pinned = vma->obj;
> +			work->pinned = i915_gem_object_get(vma->obj);
>   		}
>   	} else {
>   		vma->ops->bind_vma(vma->vm, NULL, vma, cache_level, bind_flags);
> 

Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin at intel.com>

Regards,

Tvrtko