Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 56fc3502 authored by Flora Cui's avatar Flora Cui Committed by Alex Deucher
Browse files

drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail 



Fixes the following scenario:

1. Page table bo allocated in vram and linked to man->lru.
   tbo->list_kref.refcount=2
2. Page table bo is swapped out and removed from man->lru.
   tbo->list_kref.refcount=1
3. Command submission from userspace.  Page table bo is moved
   to vram.  ttm_bo_move_to_lru_tail() link it to man->lru and
   don't increase the kref count.

Reviewed-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: default avatarFlora Cui <Flora.Cui@amd.com>
Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
parent 18cdfe75

drivers/gpu/drm/ttm/ttm_bo.c

+4 −13
Original line number Diff line number Diff line
@@ -230,22 +230,13 @@ EXPORT_SYMBOL(ttm_bo_del_sub_from_lru); 


void ttm_bo_move_to_lru_tail(struct ttm_buffer_object *bo)

{

	struct ttm_bo_device *bdev = bo->bdev;

	struct ttm_mem_type_manager *man;

	int put_count = 0;



	lockdep_assert_held(&bo->resv->lock.base);



	if (bo->mem.placement & TTM_PL_FLAG_NO_EVICT) {

		list_del_init(&bo->swap);

		list_del_init(&bo->lru);



	} else {

		if (bo->ttm && !(bo->ttm->page_flags & TTM_PAGE_FLAG_SG))

			list_move_tail(&bo->swap, &bo->glob->swap_lru);



		man = &bdev->man[bo->mem.mem_type];

		list_move_tail(&bo->lru, &man->lru);

	}

	put_count = ttm_bo_del_from_lru(bo);

	ttm_bo_list_ref_sub(bo, put_count, true);

	ttm_bo_add_to_lru(bo);

}

EXPORT_SYMBOL(ttm_bo_move_to_lru_tail);