1a961ce09f
Resending this with Thomas Hellstrom's signoff for merging into 2.6.33 ttm_bo_delayed_delete has a race condition, because after we do: kref_put(&nentry->list_kref, ttm_bo_release_list); we are not holding the list lock and not holding any reference to objects, and thus every bo in the list can be removed and freed at this point. However, we then use the next pointer we stored, which is not guaranteed to be valid. This was apparently the cause of some Nouveau oopses I experienced. This patch rewrites the function so that it keeps the reference to nentry until nentry itself is freed and we already got a reference to nentry->next. v2 updated by me according to Thomas Hellstrom's feedback. v3 proposed by Thomas Hellstrom. Commit comment updated by me. Both updates fixed minor efficiency/style issues only and all three versions should be correct. Signed-off-by: Luca Barbieri <luca@luca-barbieri.com> Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com> |
||
|---|---|---|
| .. | ||
| Makefile | ||
| ttm_agp_backend.c | ||
| ttm_bo.c | ||
| ttm_bo_util.c | ||
| ttm_bo_vm.c | ||
| ttm_execbuf_util.c | ||
| ttm_global.c | ||
| ttm_lock.c | ||
| ttm_memory.c | ||
| ttm_module.c | ||
| ttm_object.c | ||
| ttm_tt.c | ||