[PATCH 1/2] drm/ttm: unbind ttm before destroying node in accel move cleanup

[PATCH 1/2] drm/ttm: unbind ttm before destroying node in accel move cleanup

[skeggsb]

From: Ben Skeggs <bskeggs@redhat.com>

Nouveau makes the assumption that if a TTM is bound there will be a mm_node
around for it and the backwards ordering here resulted in a use-after-free
on some eviction paths.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
---
 drivers/gpu/drm/ttm/ttm_bo_util.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 77dbf40..ae3c6f5 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -635,13 +635,13 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
 		if (ret)
 			return ret;
 
-		ttm_bo_free_old_node(bo);
 		if ((man->flags & TTM_MEMTYPE_FLAG_FIXED) &&
 		    (bo->ttm != NULL)) {
 			ttm_tt_unbind(bo->ttm);
 			ttm_tt_destroy(bo->ttm);
 			bo->ttm = NULL;
 		}
+		ttm_bo_free_old_node(bo);
 	} else {
 		/**
 		 * This should help pipeline ordinary buffer moves.
-- 
1.7.6

[PATCH 2/2] drm/ttm: ensure ttm for new node is bound before calling move_notify()

[skeggsb]

From: Ben Skeggs <bskeggs@redhat.com>

This was true for new TTM_PL_SYSTEM and new TTM_PL_TT cases, but wasn't
the case on TTM_PL_SYSTEM<->TTM_PL_TT moves, which causes trouble on some
paths as nouveau's move_notify() hook requires that the dma addresses be
valid at this point.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
---
 drivers/gpu/drm/nouveau/nouveau_mem.c |    1 +
 drivers/gpu/drm/ttm/ttm_bo.c          |   10 ++++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
index 2eecf5d..b4af850 100644
--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
@@ -831,6 +831,7 @@ nouveau_gart_manager_fini(struct ttm_mem_type_manager *man)
 	return 0;
 }
 
+
 static void
 nouveau_gart_manager_del(struct ttm_mem_type_manager *man,
 			 struct ttm_mem_reg *mem)
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 2e618b5..9095b5b 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -390,10 +390,12 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
 	 * Create and bind a ttm if required.
 	 */
 
-	if (!(new_man->flags & TTM_MEMTYPE_FLAG_FIXED) && (bo->ttm == NULL)) {
-		ret = ttm_bo_add_ttm(bo, false);
-		if (ret)
-			goto out_err;
+	if (!(new_man->flags & TTM_MEMTYPE_FLAG_FIXED)) {
+		if (bo->ttm == NULL) {
+			ret = ttm_bo_add_ttm(bo, false);
+			if (ret)
+				goto out_err;
+		}
 
 		ret = ttm_tt_set_placement_caching(bo->ttm, mem->placement);
 		if (ret)
-- 
1.7.6

Re: [PATCH 1/2] drm/ttm: unbind ttm before destroying node in accel move cleanup

[Jerome Glisse]

On Sun, Aug 21, 2011 at 11:15 PM,  <skeggsb@gmail.com> wrote:
> From: Ben Skeggs <bskeggs@redhat.com>
>
> Nouveau makes the assumption that if a TTM is bound there will be a mm_node
> around for it and the backwards ordering here resulted in a use-after-free
> on some eviction paths.
>
> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
> ---
>  drivers/gpu/drm/ttm/ttm_bo_util.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
> index 77dbf40..ae3c6f5 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo_util.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
> @@ -635,13 +635,13 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
>                if (ret)
>                        return ret;
>
> -               ttm_bo_free_old_node(bo);
>                if ((man->flags & TTM_MEMTYPE_FLAG_FIXED) &&
>                    (bo->ttm != NULL)) {
>                        ttm_tt_unbind(bo->ttm);
>                        ttm_tt_destroy(bo->ttm);
>                        bo->ttm = NULL;
>                }
> +               ttm_bo_free_old_node(bo);
>        } else {
>                /**
>                 * This should help pipeline ordinary buffer moves.
> --
> 1.7.6
>
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel
>