From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ville =?iso-8859-1?Q?Syrj=E4l=E4?= Subject: Re: [PATCH] drm/i915: Reset vma->mm_list after unbinding Date: Thu, 27 Feb 2014 16:11:39 +0200 Message-ID: <20140227141139.GK3852@intel.com> References: <1393338208-10242-1-git-send-email-chris@chris-wilson.co.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Return-path: Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by gabe.freedesktop.org (Postfix) with ESMTP id 212E7FA724 for ; Thu, 27 Feb 2014 06:12:01 -0800 (PST) Content-Disposition: inline In-Reply-To: <1393338208-10242-1-git-send-email-chris@chris-wilson.co.uk> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: intel-gfx-bounces@lists.freedesktop.org Errors-To: intel-gfx-bounces@lists.freedesktop.org To: Chris Wilson Cc: intel-gfx@lists.freedesktop.org, Ben Widawsky List-Id: intel-gfx@lists.freedesktop.org On Tue, Feb 25, 2014 at 02:23:28PM +0000, Chris Wilson wrote: > In place of true activity counting, we walk the list of vma associated > with an object managing each on the vm's active/inactive list everytime > we call move-to-inactive. This depends upon the vma->mm_list being > cleared after unbinding, or else we run into difficulty when tracking > the object in multiple vm's - we see a use-after free and corruption of > the mm_list. > = > Signed-off-by: Chris Wilson > Cc: Ben Widawsky > --- > drivers/gpu/drm/i915/i915_gem.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > = > diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_= gem.c > index 633a8d56e401..4de984e176f5 100644 > --- a/drivers/gpu/drm/i915/i915_gem.c > +++ b/drivers/gpu/drm/i915/i915_gem.c > @@ -2874,7 +2874,7 @@ int i915_vma_unbind(struct i915_vma *vma) > = > i915_gem_gtt_finish_object(obj); > = > - list_del(&vma->mm_list); > + list_del_init(&vma->mm_list); Isn't this just another symptom of the vma unbind recursion bug? I mean how can someone else be accessing vma->mm_list while we're in the process of freeing the vma itself (happens just a few lines down from here). > if (i915_is_ggtt(vma->vm)) > obj->map_and_fenceable =3D false; > = > -- = > 1.9.0 > = > _______________________________________________ > Intel-gfx mailing list > Intel-gfx@lists.freedesktop.org > http://lists.freedesktop.org/mailman/listinfo/intel-gfx -- = Ville Syrj=E4l=E4 Intel OTC