The LRU mechanism may look up a resource in the process of being removed
from an object. The locking rules here are a bit unclear but it looks
currently like res->bo assignment is protected by the LRU lock, whereas
bo->resource is protected by the object lock, while *clearing* of
bo->resource is also protected by the LRU lock. This means that if
we check that bo->resource points to the LRU resource under the LRU
lock we should be safe.
So perform that check before deciding to swap out a bo. That avoids
dereferencing a NULL bo->resource in ttm_bo_swapout().
Fixes: 6a9b02899402 ("drm/ttm: move the LRU into resource handling v4")
Cc: Christian König <christian.koe...@amd.com>
Cc: Daniel Vetter <daniel.vet...@ffwll.ch>
Cc: Christian Koenig <christian.koe...@amd.com>
Cc: Huang Rui <ray.hu...@amd.com>
Cc: Alex Deucher <alexander.deuc...@amd.com>
Cc: Felix Kuehling <felix.kuehl...@amd.com>
Cc: Philip Yang <philip.y...@amd.com>
Cc: Qiang Yu <qiang...@amd.com>
Cc: Matthew Auld <matthew.a...@intel.com>
Cc: Nirmoy Das <nirmoy....@intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursu...@intel.com>
Cc: "Thomas Hellström" <thomas.hellst...@linux.intel.com>
Cc: Anshuman Gupta <anshuman.gu...@intel.com>
Cc: Ramalingam C <ramalinga...@intel.com>
Cc: Arunpravin Paneer Selvam <arunpravin.paneersel...@amd.com>
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Thomas Hellström <thomas.hellst...@linux.intel.com>
---
drivers/gpu/drm/ttm/ttm_device.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/ttm/ttm_device.c b/drivers/gpu/drm/ttm/ttm_device.c
index c7a1862f322a..ae2f19dc9f81 100644
--- a/drivers/gpu/drm/ttm/ttm_device.c
+++ b/drivers/gpu/drm/ttm/ttm_device.c
@@ -158,7 +158,7 @@ int ttm_device_swapout(struct ttm_device *bdev, struct
ttm_operation_ctx *ctx,
struct ttm_buffer_object *bo = res->bo;
uint32_t num_pages;
- if (!bo)
+ if (!bo || bo->resource != res)
continue;
num_pages = PFN_UP(bo->base.size);
--
2.34.1
