[PATCH 1/2] drm/xe: Fix unlocked access of the vma::rebind_link

[Thomas Hellström]

the vma::rebind_link is protected by the vm's resv, but we was
modifying it without. Fix this by use the vma::userptr_link instead
for the tmp_evict list. The vma::userptr_link is protected by the
vm lock.

Signed-off-by: Thomas Hellström <thomas.hellst...@linux.intel.com>
---
 drivers/gpu/drm/xe/xe_vm.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index 0a4becdf4675..5f93d78c2e58 100644
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -764,8 +764,7 @@ int xe_vm_userptr_pin(struct xe_vm *vm)
                if (err < 0)
                        goto out_err;
 
-               list_del_init(&vma->userptr_link);
-               list_move_tail(&vma->rebind_link, &tmp_evict);
+               list_move_tail(&vma->userptr_link, &tmp_evict);
        }
 
        /* Take lock and move to rebind_list for rebinding. */
@@ -773,16 +772,17 @@ int xe_vm_userptr_pin(struct xe_vm *vm)
        if (err)
                goto out_err;
 
-       list_splice_tail(&tmp_evict, &vm->rebind_list);
+       list_for_each_entry_safe(vma, next, &tmp_evict, userptr_link) {
+               list_del_init(&vma->userptr_link);
+               list_move_tail(&vma->rebind_link, &vm->rebind_list);
+       }
+
        dma_resv_unlock(&vm->resv);
 
        return 0;
 
 out_err:
-       list_for_each_entry_safe(vma, next, &tmp_evict, rebind_link) {
-               list_del_init(&vma->rebind_link);
-               list_add_tail(&vma->userptr_link, &vm->userptr.repin_list);
-       }
+       list_splice_tail(&tmp_evict, &vm->userptr.repin_list);
 
        return err;
 }
-- 
2.39.2