drm/ttm: fix bulk_move corruption when adding a entry
authorYunxiang Li <Yunxiang.Li@amd.com>
Thu, 22 Jun 2023 14:18:03 +0000 (10:18 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 27 Jul 2023 06:50:49 +0000 (08:50 +0200)
commit70a3015683b007a0db4a1e858791b69afd45fc83
tree1ae1561f709bf1fbc5bc39c8985c6b32699cfddb
parent61622fa3791495129b27c71a25f3184a8c332c8c
drm/ttm: fix bulk_move corruption when adding a entry

commit 4481913607e58196c48a4fef5e6f45350684ec3c upstream.

When the resource is the first in the bulk_move range, adding it again
(thus moving it to the tail) will corrupt the list since the first
pointer is not moved. This eventually lead to null pointer deref in
ttm_lru_bulk_move_del()

Fixes: fee2ede15542 ("drm/ttm: rework bulk move handling v5")
Signed-off-by: Yunxiang Li <Yunxiang.Li@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
CC: stable@vger.kernel.org
Link: https://patchwork.freedesktop.org/patch/msgid/20230622141902.28718-3-Yunxiang.Li@amd.com
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/gpu/drm/ttm/ttm_resource.c