From: Christian König <christian.koenig@amd.com>
Date: Fri, 31 Aug 2018 13:06:35 +0000 (+0200)
Subject: drm/ttm: fix ttm_bo_bulk_move_helper
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=972a21f94631642d6714bb2a1983b7b15a77526d;p=openwrt%2Fstaging%2Fblogic.git

drm/ttm: fix ttm_bo_bulk_move_helper

Staring at the function for six hours, just to essentially move one line
of code. The problem was that the first list_cut_position call could result
in list2 pointing to la-la-land.

Signed-off-by: Christian König <christian.koenig@amd.com>
Tested-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---

diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 35d53d81f486..138c98902033 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -250,15 +250,18 @@ EXPORT_SYMBOL(ttm_bo_move_to_lru_tail);
 static void ttm_bo_bulk_move_helper(struct ttm_lru_bulk_move_pos *pos,
 				    struct list_head *lru, bool is_swap)
 {
+	struct list_head *list;
 	LIST_HEAD(entries);
 	LIST_HEAD(before);
-	struct list_head *list1, *list2;
 
-	list1 = is_swap ? &pos->last->swap : &pos->last->lru;
-	list2 = is_swap ? pos->first->swap.prev : pos->first->lru.prev;
+	reservation_object_assert_held(pos->last->resv);
+	list = is_swap ? &pos->last->swap : &pos->last->lru;
+	list_cut_position(&entries, lru, list);
+
+	reservation_object_assert_held(pos->first->resv);
+	list = is_swap ? pos->first->swap.prev : pos->first->lru.prev;
+	list_cut_position(&before, &entries, list);
 
-	list_cut_position(&entries, lru, list1);
-	list_cut_position(&before, &entries, list2);
 	list_splice(&before, lru);
 	list_splice_tail(&entries, lru);
 }