From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mika Kuoppala Subject: Re: [PATCH] drm/i915: Fix erroneous dereference of batch_obj inside reset_status Date: Thu, 05 Dec 2013 18:07:27 +0200 Message-ID: <87haan9t8g.fsf@gaia.fi.intel.com> References: <1386157029-5954-1-git-send-email-chris@chris-wilson.co.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by gabe.freedesktop.org (Postfix) with ESMTP id 3DE3EFAB26 for ; Thu, 5 Dec 2013 08:08:32 -0800 (PST) In-Reply-To: <1386157029-5954-1-git-send-email-chris@chris-wilson.co.uk> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: intel-gfx-bounces@lists.freedesktop.org Errors-To: intel-gfx-bounces@lists.freedesktop.org To: Chris Wilson , intel-gfx@lists.freedesktop.org Cc: stable@vger.kernel.org List-Id: intel-gfx@lists.freedesktop.org Chris Wilson writes: > As the rings may be processed and their requests deallocated in a > different order to the natural retirement during a reset, > > /* Whilst this request exists, batch_obj will be on the > * active_list, and so will hold the active reference. Only when this > * request is retired will the the batch_obj be moved onto the > * inactive_list and lose its active reference. Hence we do not need > * to explicitly hold another reference here. > */ > > is violated, and the batch_obj may be dereferenced after it had been > freed on another ring. This can be simply avoided by processing the > status update prior to deallocating any requests. > > Fixes regression (a possible OOPS following a GPU hang) from > commit aa60c664e6df502578454621c3a9b1f087ff8d25 > Author: Mika Kuoppala > Date: Wed Jun 12 15:13:20 2013 +0300 > > drm/i915: find guilty batch buffer on ring resets > > Signed-off-by: Chris Wilson > Cc: Mika Kuoppala > Cc: stable@vger.kernel.org Passes the igt/gem_reset_stats/close-pending-fork and doesn't affect the fast path. Reviewed-by: Mika Kuoppala