Patch "drm/ttm: never add BO that failed to validate to the LRU list" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

drm/ttm: never add BO that failed to validate to the LRU list

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
drm-ttm-never-add-bo-that-failed-to-validate-to-the-lru-list.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: "Nicolai H�hnle" <[email protected]>
Date: Tue, 14 Feb 2017 09:37:12 +0100
Subject: drm/ttm: never add BO that failed to validate to the LRU list

From: "Nicolai H�hnle" <[email protected]>

[ Upstream commit c2c139cf435b18939204800fa72c53a7207bdd68 ]

Fixes a potential race condition in amdgpu that looks as follows:

Task 1: attempt ttm_bo_init, but ttm_bo_validate fails Task 1: add BO to global list anyway
Task 2: grabs hold of the BO, waits on its reservation lock Task 1: releases its reference of the BO; never gives up the
reservation lock

The patch "drm/amdgpu: fix a potential deadlock in amdgpu_bo_create_restricted()" attempts to fix that by releasing the reservation lock in amdgpu code; unfortunately, it introduces a use-after-free when this race _doesn't_ happen.

This patch should fix the race properly by never adding the BO to the global list in the first place.

---
 drivers/gpu/drm/ttm/ttm_bo.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

@@ -1209,18 +1209,20 @@ int ttm_bo_init(struct ttm_bo_device *bd
 	if (likely(!ret))
 		ret = ttm_bo_validate(bo, placement, interruptible, false);
 
-	if (!resv) {
+	if (!resv)
 		ttm_bo_unreserve(bo);
 
-	} else if (!(bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) {
+	if (unlikely(ret)) {
+		ttm_bo_unref(&bo);
+		return ret;
+	}
+
+	if (resv && !(bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) {
 		spin_lock(&bo->glob->lru_lock);
 		ttm_bo_add_to_lru(bo);
 		spin_unlock(&bo->glob->lru_lock);
 	}
 
-	if (unlikely(ret))
-		ttm_bo_unref(&bo);
-
 	return ret;
 }
 EXPORT_SYMBOL(ttm_bo_init);

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/drm-ttm-never-add-bo-that-failed-to-validate-to-the-lru-list.patch