[Intel-xe] [PATCH 1/2] drm/xe: Fix unlocked access of the vma::rebind_link

[Matthew Brost]

On Wed, May 10, 2023 at 04:19:31PM +0200, Thomas Hellström wrote:
> the vma::rebind_link is protected by the vm's resv, but we was
> modifying it without. Fix this by use the vma::userptr_link instead
> for the tmp_evict list. The vma::userptr_link is protected by the
> vm lock.
> 
> Signed-off-by: Thomas Hellström <thomas.hellstrom at linux.intel.com>

Reviewed-by: Matthew Brost <matthew.brost at intel.com>

> ---
>  drivers/gpu/drm/xe/xe_vm.c | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
> index 0a4becdf4675..5f93d78c2e58 100644
> --- a/drivers/gpu/drm/xe/xe_vm.c
> +++ b/drivers/gpu/drm/xe/xe_vm.c
> @@ -764,8 +764,7 @@ int xe_vm_userptr_pin(struct xe_vm *vm)
>  		if (err < 0)
>  			goto out_err;
>  
> -		list_del_init(&vma->userptr_link);
> -		list_move_tail(&vma->rebind_link, &tmp_evict);
> +		list_move_tail(&vma->userptr_link, &tmp_evict);
>  	}
>  
>  	/* Take lock and move to rebind_list for rebinding. */
> @@ -773,16 +772,17 @@ int xe_vm_userptr_pin(struct xe_vm *vm)
>  	if (err)
>  		goto out_err;
>  
> -	list_splice_tail(&tmp_evict, &vm->rebind_list);
> +	list_for_each_entry_safe(vma, next, &tmp_evict, userptr_link) {
> +		list_del_init(&vma->userptr_link);
> +		list_move_tail(&vma->rebind_link, &vm->rebind_list);
> +	}
> +
>  	dma_resv_unlock(&vm->resv);
>  
>  	return 0;
>  
>  out_err:
> -	list_for_each_entry_safe(vma, next, &tmp_evict, rebind_link) {
> -		list_del_init(&vma->rebind_link);
> -		list_add_tail(&vma->userptr_link, &vm->userptr.repin_list);
> -	}
> +	list_splice_tail(&tmp_evict, &vm->userptr.repin_list);
>  
>  	return err;
>  }
> -- 
> 2.39.2
>