From mboxrd@z Thu Jan  1 00:00:00 1970
From: Ben Widawsky <ben@bwidawsk.net>
Subject: Re: drm/i915: Switch eviction code to use vmas
Date: Mon, 19 Aug 2013 15:15:04 -0700
Message-ID: <20130819221503.GA1059@bwidawsk.net>
References: <20130819065914.GD28591@elgon.mountain>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <intel-gfx-bounces+gcfxdi-intel-gfx=m.gmane.org@lists.freedesktop.org>
Received: from mail.bwidawsk.net (bwidawsk.net [166.78.191.112])
	by gabe.freedesktop.org (Postfix) with ESMTP id 53DF4E5EE6
	for <intel-gfx@lists.freedesktop.org>;
	Mon, 19 Aug 2013 15:15:08 -0700 (PDT)
Content-Disposition: inline
In-Reply-To: <20130819065914.GD28591@elgon.mountain>
List-Unsubscribe: <http://lists.freedesktop.org/mailman/options/intel-gfx>,
	<mailto:intel-gfx-request@lists.freedesktop.org?subject=unsubscribe>
List-Archive: <http://lists.freedesktop.org/archives/intel-gfx>
List-Post: <mailto:intel-gfx@lists.freedesktop.org>
List-Help: <mailto:intel-gfx-request@lists.freedesktop.org?subject=help>
List-Subscribe: <http://lists.freedesktop.org/mailman/listinfo/intel-gfx>,
	<mailto:intel-gfx-request@lists.freedesktop.org?subject=subscribe>
Sender: intel-gfx-bounces+gcfxdi-intel-gfx=m.gmane.org@lists.freedesktop.org
Errors-To: intel-gfx-bounces+gcfxdi-intel-gfx=m.gmane.org@lists.freedesktop.org
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org
List-Id: intel-gfx@lists.freedesktop.org

On Mon, Aug 19, 2013 at 09:59:14AM +0300, Dan Carpenter wrote:
> Hello Ben Widawsky,
> 
> Here is another use after free warning.  It's some new static checker
> stuff that I haven't pushed because it has lots of false postives.
> 
> The patch f7795b1d0b47: "drm/i915: Switch eviction code to use vmas" 
> from Aug 14, 2013, leads to the following warning:
> "drivers/gpu/drm/i915/i915_gem_evict.c:145 i915_gem_evict_something()
> 	 warn: 'vma' was already freed."
> 
> 
> drivers/gpu/drm/i915/i915_gem_evict.c
>    137          /* Unbinding will emit any required flushes */
>    138          while (!list_empty(&eviction_list)) {
>    139                  vma = list_first_entry(&eviction_list,
>    140                                         struct i915_vma,
>    141                                         exec_list);
>    142                  if (ret == 0)
>    143                          ret = i915_vma_unbind(vma);
>                                       ^^^^^^^^^^^^^^^^^^^^
> This often frees the "vma".
> 
>    144  
>    145                  list_del_init(&vma->exec_list);
>                                       ^^^^^^^^^^^^^^^
> Dereference.
> 
>    146                  drm_gem_object_unreference(&vma->obj->base);
>    147          }
> 
> regards,
> dan carpenter
> 

Hi Dan. This should already be fixed. Do we need to cc:stable this?
http://cgit.freedesktop.org/~danvet/drm-intel/commit/?h=drm-intel-next-queued&id=a322b7c1fc7e491c797d8015da4c2e5178cada2d

-- 
Ben Widawsky, Intel Open Source Technology Center