drm/i915: Pin pages whilst allocating for dma-buf vmap()
authorChris Wilson <chris@chris-wilson.co.uk>
Fri, 29 Nov 2013 11:44:59 +0000 (11:44 +0000)
committerDaniel Vetter <daniel.vetter@ffwll.ch>
Fri, 29 Nov 2013 14:51:20 +0000 (15:51 +0100)
commit993fc6ebaf4af6fdfde08cc8649c386e483a5908
treedf8cee442fc9fcafc8fa565a2fd626542996ba9d
parent0bf2134780e321a8af93315d99e575a821ee1a77
drm/i915: Pin pages whilst allocating for dma-buf vmap()

During the vmap() routine for the dma-buf, we first grab the pages and
then try to allocate a temporary array to pass to the vmap(). However,
the shrinker can and will reap any object that is unbound if the
allocation for the array first fails. This includes the object which we
are attempting to vmap(). The solution is to mark the object's pages as
pinned whilst we try the allocation to prevent the use-after-free
introduced by the potential shrinkage.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
drivers/gpu/drm/i915/i915_gem_dmabuf.c