From patchwork Wed Jun 4 06:16:54 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 4292031 Return-Path: X-Original-To: patchwork-intel-gfx@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id E4BBDBEEA7 for ; Wed, 4 Jun 2014 06:17:01 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 086A1202F8 for ; Wed, 4 Jun 2014 06:17:01 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 20729202D1 for ; Wed, 4 Jun 2014 06:17:00 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id CCEF96E7B6; Tue, 3 Jun 2014 23:16:59 -0700 (PDT) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) by gabe.freedesktop.org (Postfix) with ESMTP id AB69B6E395 for ; Tue, 3 Jun 2014 23:16:58 -0700 (PDT) Received: from localhost (c-76-28-255-20.hsd1.wa.comcast.net [76.28.255.20]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 818AD89D; Wed, 4 Jun 2014 06:16:58 +0000 (UTC) To: daniel.vetter@ffwll.ch, ben@bwidawsk.net, chris@chris-wilson.co.uk, gregkh@linuxfoundation.org, intel-gfx@lists.freedesktop.org, mar.kolya@gmail.com From: Date: Tue, 03 Jun 2014 23:16:54 -0700 In-Reply-To: <1400663245-15601-4-git-send-email-daniel.vetter@ffwll.ch> Message-ID: <14018626143099@kroah.com> MIME-Version: 1.0 Cc: stable@vger.kernel.org, stable-commits@vger.kernel.org Subject: [Intel-gfx] Patch "drm/i915: Fix unsafe loop iteration over vma whilst unbinding them" has been added to the 3.14-stable tree X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" X-Spam-Status: No, score=-4.8 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This is a note to let you know that I've just added the patch titled drm/i915: Fix unsafe loop iteration over vma whilst unbinding them to the 3.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: drm-i915-fix-unsafe-loop-iteration-over-vma-whilst-unbinding-them.patch and it can be found in the queue-3.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. From daniel.vetter@ffwll.ch Tue Jun 3 23:13:34 2014 From: Daniel Vetter Date: Wed, 21 May 2014 11:07:24 +0200 Subject: drm/i915: Fix unsafe loop iteration over vma whilst unbinding them To: stable@vger.kernel.org Cc: Intel Graphics Development , Chris Wilson , Ben Widawsky , Daniel Vetter Message-ID: <1400663245-15601-4-git-send-email-daniel.vetter@ffwll.ch> From: Chris Wilson This is commit df6f783a4ef6790780a67c491897ac upstream. On non-LLC platforms, when changing the cache level of an object, we may need to unbind it so that prefetching across page boundaries does not cross into a different memory domain. This requires us to unbind conflicting vma, but we did so iterating over the objects vma in an unsafe manner (as the list was being modified as we iterated). The regression was introduced in commit 3089c6f239d7d2c4cb2dd5c353e8984cf79af1d7 Author: Ben Widawsky Date: Wed Jul 31 17:00:03 2013 -0700 drm/i915: make caching operate on all address spaces apparently as far back as v3.12-rc1, but it has only just begun to trigger real world bug reports. Reported-and-tested-by: Nikolay Martynov Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=76384 Signed-off-by: Chris Wilson Cc: Ben Widawsky Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/i915/i915_gem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Patches currently in stable-queue which might be from daniel.vetter@ffwll.ch are queue-3.14/drm-i915-don-t-warn-nor-handle-unexpected-hpd-interrupts-on-gmch-platforms.patch queue-3.14/drm-i915-fix-unsafe-loop-iteration-over-vma-whilst-unbinding-them.patch queue-3.14/drm-i915-disable-self-refresh-for-untiled-fbs-on-i915gm.patch queue-3.14/drm-i915-don-t-check-gmch-state-on-inherited-configs.patch queue-3.14/drm-i915-break-encoder-crtc-link-separately-in-intel_sanitize_crtc.patch queue-3.14/drm-i915-quirk-invert-brightness-for-acer-aspire-5336.patch queue-3.14/drm-i915-move-power-domain-init-earlier-during-system-resume.patch --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -3529,7 +3529,7 @@ int i915_gem_object_set_cache_level(stru { struct drm_device *dev = obj->base.dev; drm_i915_private_t *dev_priv = dev->dev_private; - struct i915_vma *vma; + struct i915_vma *vma, *next; int ret; if (obj->cache_level == cache_level) @@ -3540,7 +3540,7 @@ int i915_gem_object_set_cache_level(stru return -EBUSY; } - list_for_each_entry(vma, &obj->vma_list, vma_link) { + list_for_each_entry_safe(vma, next, &obj->vma_list, vma_link) { if (!i915_gem_valid_gtt_space(dev, &vma->node, cache_level)) { ret = i915_vma_unbind(vma); if (ret)