Commit 922d369b authored by Chris Wilson's avatar Chris Wilson Committed by Rodrigo Vivi

drm/i915/gt: Clear the buffer pool age before use

If we create a new node, it is possible for the slab allocator to return
us a recently freed node. If that node was just retired, it will retain
the current jiffy as its node->age. There is then a miniscule window,
where as that node is retired, it will appear on the free list with an
incorrect age and be eligible for reuse by one thread, and then by a
second thread as the correct node->age is written.

Fixes: 06b73c2d ("drm/i915/gt: Delay taking the spinlock for grabbing from the buffer pool")
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: default avatarMatthew Auld <matthew.auld@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200915091417.4086-3-chris@chris-wilson.co.uk
(cherry picked from commit 9bb34ff25c458a2a48fb61409df42f465ede37f8)
Signed-off-by: default avatarRodrigo Vivi <rodrigo.vivi@intel.com>
parent ba2ebf60
...@@ -134,6 +134,7 @@ static void pool_retire(struct i915_active *ref) ...@@ -134,6 +134,7 @@ static void pool_retire(struct i915_active *ref)
/* Return this object to the shrinker pool */ /* Return this object to the shrinker pool */
i915_gem_object_make_purgeable(node->obj); i915_gem_object_make_purgeable(node->obj);
GEM_BUG_ON(node->age);
spin_lock_irqsave(&pool->lock, flags); spin_lock_irqsave(&pool->lock, flags);
list_add_rcu(&node->link, list); list_add_rcu(&node->link, list);
WRITE_ONCE(node->age, jiffies ?: 1); /* 0 reserved for active nodes */ WRITE_ONCE(node->age, jiffies ?: 1); /* 0 reserved for active nodes */
...@@ -155,6 +156,7 @@ node_create(struct intel_gt_buffer_pool *pool, size_t sz) ...@@ -155,6 +156,7 @@ node_create(struct intel_gt_buffer_pool *pool, size_t sz)
if (!node) if (!node)
return ERR_PTR(-ENOMEM); return ERR_PTR(-ENOMEM);
node->age = 0;
node->pool = pool; node->pool = pool;
i915_active_init(&node->active, pool_active, pool_retire); i915_active_init(&node->active, pool_active, pool_retire);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment