drm/ttm: never add BO that failed to validate to the LRU list
authorNicolai Hähnle <nicolai.haehnle@amd.com>
Tue, 14 Feb 2017 08:37:12 +0000 (09:37 +0100)
committerAlex Deucher <alexander.deucher@amd.com>
Thu, 30 Mar 2017 03:53:05 +0000 (23:53 -0400)
commitc2c139cf435b18939204800fa72c53a7207bdd68
tree08b8a88fd40b7ceb4e3c82c7c74eeeb0f5ea3f29
parent5ebbac4b5c9159130046bf7c56b7f4c71ca7d1b7
drm/ttm: never add BO that failed to validate to the LRU list

Fixes a potential race condition in amdgpu that looks as follows:

Task 1: attempt ttm_bo_init, but ttm_bo_validate fails
Task 1: add BO to global list anyway
Task 2: grabs hold of the BO, waits on its reservation lock
Task 1: releases its reference of the BO; never gives up the
        reservation lock

The patch "drm/amdgpu: fix a potential deadlock in
amdgpu_bo_create_restricted()" attempts to fix that by releasing
the reservation lock in amdgpu code; unfortunately, it introduces
a use-after-free when this race _doesn't_ happen.

This patch should fix the race properly by never adding the BO
to the global list in the first place.

Cc: zhoucm1 <david1.zhou@amd.com>
Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
Tested-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/ttm/ttm_bo.c