drm/ttm: never add BO that failed to validate to the LRU list

[ Upstream commit c2c139cf435b18939204800fa72c53a7207bdd68 ]

Fixes a potential race condition in amdgpu that looks as follows:

Task 1: attempt ttm_bo_init, but ttm_bo_validate fails
Task 1: add BO to global list anyway
Task 2: grabs hold of the BO, waits on its reservation lock
Task 1: releases its reference of the BO; never gives up the
        reservation lock

The patch "drm/amdgpu: fix a potential deadlock in
amdgpu_bo_create_restricted()" attempts to fix that by releasing
the reservation lock in amdgpu code; unfortunately, it introduces
a use-after-free when this race _doesn't_ happen.

This patch should fix the race properly by never adding the BO
to the global list in the first place.

Cc: zhoucm1 <david1.zhou@amd.com>
Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
Tested-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index d09276ec7e902835902cb860841c5db4ec2ed3b5..52a2a1a75682d8aca9161176f29d08d142e294cb 100644 (file)
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1209,18 +1209,20 @@ int ttm_bo_init(struct ttm_bo_device *bdev,
        if (likely(!ret))
                ret = ttm_bo_validate(bo, placement, interruptible, false);
 
-       if (!resv) {
+       if (!resv)
                ttm_bo_unreserve(bo);
 
-       } else if (!(bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) {
+       if (unlikely(ret)) {
+               ttm_bo_unref(&bo);
+               return ret;
+       }
+
+       if (resv && !(bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) {
                spin_lock(&bo->glob->lru_lock);
                ttm_bo_add_to_lru(bo);
                spin_unlock(&bo->glob->lru_lock);
        }
 
-       if (unlikely(ret))
-               ttm_bo_unref(&bo);
-
        return ret;
 }
 EXPORT_SYMBOL(ttm_bo_init);