drm/panfrost: Fix shrinker list corruption by madvise IOCTL

Calling madvise IOCTL twice on BO causes memory shrinker list corruption and crashes kernel because BO is already on the list and it's added to the list again, while BO should be removed from the list before it's re-added. Fix it.

Dmitry Osipenko committed 4 years ago

Commit 9fc33ea1 parent fb6e0631 file · +2 −2Browse files

Unified · Split

drivers/gpu/drm/panfrost/panfrost_drv.c+2−2

@@ -433,8 +433,8 @@ static int panfrost_ioctl_madvise(struct drm_device dev, void data, · 432 unmodified lines
433	433
434	434	if (args->retained) {
435	435	if (args->madv == PANFROST_MADV_DONTNEED)
436		− list_add_tail(&bo->base.madv_list,
437		− &pfdev->shrinker_list);
	436	+ list_move_tail(&bo->base.madv_list,
	437	+ &pfdev->shrinker_list);
438	438	else if (args->madv == PANFROST_MADV_WILLNEED)
439	439	list_del_init(&bo->base.madv_list);
440	440	}