diff options
| author | Michel Thierry <michel.thierry@intel.com> | 2014-09-09 16:04:43 +0400 |
|---|---|---|
| committer | Daniel Vetter <daniel.vetter@ffwll.ch> | 2014-09-19 16:41:16 +0400 |
| commit | cf303626748e0a5c059e453d025539583d870116 (patch) | |
| tree | 377e1c45d9ba381b44d70bb3b81adea0686b9447 /drivers/gpu/drm/i915/i915_gem_evict.c | |
| parent | a1e470d421f68d69bf35c1ed316a861625010eab (diff) | |
| download | linux-cf303626748e0a5c059e453d025539583d870116.tar.xz | |
drm/i915: fix another use-after-free in i915_gem_evict_everything
Also here, i915_gem_evict_vm causes an unbind, which can end up dropping
the last ref to the ppgtt.
Triggered by igt gem_evict_everything test.
Testcase: igt/gem_evict_everything
Signed-off-by: Michel Thierry <michel.thierry@intel.com>
Reviewed-by: Chris Wilson <chris@cris-wilsonc.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Diffstat (limited to 'drivers/gpu/drm/i915/i915_gem_evict.c')
| -rw-r--r-- | drivers/gpu/drm/i915/i915_gem_evict.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c index bbf4b12d842e..886ff2ee7a28 100644 --- a/drivers/gpu/drm/i915/i915_gem_evict.c +++ b/drivers/gpu/drm/i915/i915_gem_evict.c @@ -243,7 +243,7 @@ int i915_gem_evict_everything(struct drm_device *dev) { struct drm_i915_private *dev_priv = dev->dev_private; - struct i915_address_space *vm; + struct i915_address_space *vm, *v; bool lists_empty = true; int ret; @@ -270,7 +270,7 @@ i915_gem_evict_everything(struct drm_device *dev) i915_gem_retire_requests(dev); /* Having flushed everything, unbind() should never raise an error */ - list_for_each_entry(vm, &dev_priv->vm_list, global_link) + list_for_each_entry_safe(vm, v, &dev_priv->vm_list, global_link) WARN_ON(i915_gem_evict_vm(vm, false)); return 0; |