From: Ben Widawsky <benjamin.widawsky@intel.com>
To: intel-gfx@lists.freedesktop.org
Cc: Ben Widawsky <ben@bwidawsk.net>,
Ben Widawsky <benjamin.widawsky@intel.com>
Subject: [PATCH] drm/i915/vma: Correct use after free in eviction
Date: Fri, 16 Aug 2013 10:43:44 -0700 [thread overview]
Message-ID: <1376675024-779-1-git-send-email-benjamin.widawsky@intel.com> (raw)
The vma will [possibly] be destroyed during unbind in eviction.
Immediately after this, we try to delete the list entry.
Chris and Ville did the debug on this before I woke up, I just get to
take credit for the fix :p
Reported-by: Mika Kuoppala <mika.kuoppala@intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Ben Widawsky <ben@bwidawsk.net>
---
drivers/gpu/drm/i915/i915_gem_evict.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index 0cbaad4..db90261 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -139,10 +139,11 @@ found:
vma = list_first_entry(&eviction_list,
struct i915_vma,
exec_list);
+
+ list_del_init(&vma->exec_list);
if (ret == 0)
ret = i915_vma_unbind(vma);
- list_del_init(&vma->exec_list);
drm_gem_object_unreference(&vma->obj->base);
}
--
1.8.3.4
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx
next reply other threads:[~2013-08-16 17:44 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-08-16 17:43 Ben Widawsky [this message]
2013-08-16 20:29 ` [PATCH] [v2] drm/i915/vma: Correct use after free in eviction Ben Widawsky
2013-08-16 22:31 ` Chris Wilson
2013-08-18 17:26 ` Daniel Vetter
2013-08-18 22:35 ` Ben Widawsky
2013-08-19 6:39 ` Daniel Vetter
2013-08-19 8:49 ` Mika Kuoppala
2013-08-19 9:01 ` Daniel Vetter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1376675024-779-1-git-send-email-benjamin.widawsky@intel.com \
--to=benjamin.widawsky@intel.com \
--cc=ben@bwidawsk.net \
--cc=intel-gfx@lists.freedesktop.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.