drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail
Fixes the following scenario: 1. Page table bo allocated in vram and linked to man->lru. tbo->list_kref.refcount=2 2. Page table bo is swapped out and removed from man->lru. tbo->list_kref.refcount=1 3. Command submission from userspace. Page table bo is moved to vram. ttm_bo_move_to_lru_tail() link it to man->lru and don't increase the kref count. Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Flora Cui <Flora.Cui@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
This commit is contained in:
parent
18cdfe751f
commit
56fc350224
|
@ -230,22 +230,13 @@ EXPORT_SYMBOL(ttm_bo_del_sub_from_lru);
|
|||
|
||||
void ttm_bo_move_to_lru_tail(struct ttm_buffer_object *bo)
|
||||
{
|
||||
struct ttm_bo_device *bdev = bo->bdev;
|
||||
struct ttm_mem_type_manager *man;
|
||||
int put_count = 0;
|
||||
|
||||
lockdep_assert_held(&bo->resv->lock.base);
|
||||
|
||||
if (bo->mem.placement & TTM_PL_FLAG_NO_EVICT) {
|
||||
list_del_init(&bo->swap);
|
||||
list_del_init(&bo->lru);
|
||||
|
||||
} else {
|
||||
if (bo->ttm && !(bo->ttm->page_flags & TTM_PAGE_FLAG_SG))
|
||||
list_move_tail(&bo->swap, &bo->glob->swap_lru);
|
||||
|
||||
man = &bdev->man[bo->mem.mem_type];
|
||||
list_move_tail(&bo->lru, &man->lru);
|
||||
}
|
||||
put_count = ttm_bo_del_from_lru(bo);
|
||||
ttm_bo_list_ref_sub(bo, put_count, true);
|
||||
ttm_bo_add_to_lru(bo);
|
||||
}
|
||||
EXPORT_SYMBOL(ttm_bo_move_to_lru_tail);
|
||||
|
||||
|
|
Loading…
Reference in New Issue