From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:60731 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752646AbcEAXUd (ORCPT ); Sun, 1 May 2016 19:20:33 -0400 Subject: Patch "drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail" has been added to the 4.5-stable tree To: Flora.Cui@amd.com, alexander.deucher@amd.com, christian.koenig@amd.com, gregkh@linuxfoundation.org, thellstrom@vmware.com Cc: , From: Date: Sun, 01 May 2016 16:20:30 -0700 Message-ID: <1462144830191195@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail to the 4.5-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: drm-ttm-fix-kref-count-mess-in-ttm_bo_move_to_lru_tail.patch and it can be found in the queue-4.5 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 56fc350224f16901db709cd8cba86bac751aa2a2 Mon Sep 17 00:00:00 2001 From: Flora Cui Date: Wed, 20 Apr 2016 10:23:47 +0800 Subject: drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Flora Cui commit 56fc350224f16901db709cd8cba86bac751aa2a2 upstream. Fixes the following scenario: 1. Page table bo allocated in vram and linked to man->lru. tbo->list_kref.refcount=2 2. Page table bo is swapped out and removed from man->lru. tbo->list_kref.refcount=1 3. Command submission from userspace. Page table bo is moved to vram. ttm_bo_move_to_lru_tail() link it to man->lru and don't increase the kref count. Reviewed-by: Thomas Hellstrom Signed-off-by: Flora Cui Reviewed-by: Christian König Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/ttm/ttm_bo.c | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) --- a/drivers/gpu/drm/ttm/ttm_bo.c +++ b/drivers/gpu/drm/ttm/ttm_bo.c @@ -230,22 +230,13 @@ EXPORT_SYMBOL(ttm_bo_del_sub_from_lru); void ttm_bo_move_to_lru_tail(struct ttm_buffer_object *bo) { - struct ttm_bo_device *bdev = bo->bdev; - struct ttm_mem_type_manager *man; + int put_count = 0; lockdep_assert_held(&bo->resv->lock.base); - if (bo->mem.placement & TTM_PL_FLAG_NO_EVICT) { - list_del_init(&bo->swap); - list_del_init(&bo->lru); - - } else { - if (bo->ttm && !(bo->ttm->page_flags & TTM_PAGE_FLAG_SG)) - list_move_tail(&bo->swap, &bo->glob->swap_lru); - - man = &bdev->man[bo->mem.mem_type]; - list_move_tail(&bo->lru, &man->lru); - } + put_count = ttm_bo_del_from_lru(bo); + ttm_bo_list_ref_sub(bo, put_count, true); + ttm_bo_add_to_lru(bo); } EXPORT_SYMBOL(ttm_bo_move_to_lru_tail); Patches currently in stable-queue which might be from Flora.Cui@amd.com are queue-4.5/drm-ttm-fix-kref-count-mess-in-ttm_bo_move_to_lru_tail.patch