Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

drm/panfrost: Fix shrinker list corruption by madvise IOCTL

Calling madvise IOCTL twice on BO causes memory shrinker list corruption
and crashes kernel because BO is already on the list and it's added to
the list again, while BO should be removed from the list before it's
re-added. Fix it.

Cc: stable@vger.kernel.org
Fixes: 013b65101315 ("drm/panfrost: Add madvise and shrinker support")
Acked-by: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220630200601.1884120-3-dmitry.osipenko@collabora.com

authored by

Dmitry Osipenko and committed by
Steven Price
9fc33eaa fb6e0637

+2 -2
+2 -2
drivers/gpu/drm/panfrost/panfrost_drv.c
··· 433 433 434 434 if (args->retained) { 435 435 if (args->madv == PANFROST_MADV_DONTNEED) 436 - list_add_tail(&bo->base.madv_list, 437 - &pfdev->shrinker_list); 436 + list_move_tail(&bo->base.madv_list, 437 + &pfdev->shrinker_list); 438 438 else if (args->madv == PANFROST_MADV_WILLNEED) 439 439 list_del_init(&bo->base.madv_list); 440 440 }