The vma will [possibly] be destroyed during unbind in eviction.
Immediately after this, we try to delete the list entry.
Chris and Ville did the debug on this before I woke up, I just get to
take credit for the fix :p
v2: Missed the drm_object_unreference use after free (Ville)
Reported-by: Mika Kuoppala <mika.kuopp...@intel.com>
Cc: Ville Syrjälä <ville.syrj...@linux.intel.com>
Cc: Chris Wilson <ch...@chris-wilson.co.uk>
Signed-off-by: Ben Widawsky <b...@bwidawsk.net>
---
drivers/gpu/drm/i915/i915_gem_evict.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c
b/drivers/gpu/drm/i915/i915_gem_evict.c
index 0cbaad4..3b7b74e 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -136,14 +136,17 @@ found:
/* Unbinding will emit any required flushes */
while (!list_empty(&eviction_list)) {
+ struct drm_gem_object *obj;
vma = list_first_entry(&eviction_list,
struct i915_vma,
exec_list);
+
+ obj = &vma->obj->base;
+ list_del_init(&vma->exec_list);
if (ret == 0)
ret = i915_vma_unbind(vma);
- list_del_init(&vma->exec_list);
- drm_gem_object_unreference(&vma->obj->base);
+ drm_gem_object_unreference(obj);
}
return ret;
--
1.8.3.4
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx
