Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c2c139cf authored by Nicolai Hähnle's avatar Nicolai Hähnle Committed by Alex Deucher
Browse files

drm/ttm: never add BO that failed to validate to the LRU list 



Fixes a potential race condition in amdgpu that looks as follows:

Task 1: attempt ttm_bo_init, but ttm_bo_validate fails
Task 1: add BO to global list anyway
Task 2: grabs hold of the BO, waits on its reservation lock
Task 1: releases its reference of the BO; never gives up the
        reservation lock

The patch "drm/amdgpu: fix a potential deadlock in
amdgpu_bo_create_restricted()" attempts to fix that by releasing
the reservation lock in amdgpu code; unfortunately, it introduces
a use-after-free when this race _doesn't_ happen.

This patch should fix the race properly by never adding the BO
to the global list in the first place.

Cc: zhoucm1 <david1.zhou@amd.com>
Signed-off-by: default avatarNicolai Hähnle <nicolai.haehnle@amd.com>
Tested-by: default avatarSamuel Pitoiset <samuel.pitoiset@gmail.com>
Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 5ebbac4b

drivers/gpu/drm/ttm/ttm_bo.c

+7 −5
Original line number Diff line number Diff line
@@ -1188,18 +1188,20 @@ int ttm_bo_init(struct ttm_bo_device *bdev, 
	if (likely(!ret))

		ret = ttm_bo_validate(bo, placement, interruptible, false);



	if (!resv) {

	if (!resv)

		ttm_bo_unreserve(bo);



	} else if (!(bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) {

	if (unlikely(ret)) {

		ttm_bo_unref(&bo);

		return ret;

	}



	if (resv && !(bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) {

		spin_lock(&bo->glob->lru_lock);

		ttm_bo_add_to_lru(bo);

		spin_unlock(&bo->glob->lru_lock);

	}



	if (unlikely(ret))

		ttm_bo_unref(&bo);



	return ret;

}

EXPORT_SYMBOL(ttm_bo_init);