sna: Only couple up a proxy->rq when inserting into the request->buffers list

Otherwise, we may never decouple it again afterwards leading to a
dangling pointer dereference.

Bugzilla: https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/1289923
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

diff --git a/src/sna/kgem.c b/src/sna/kgem.c
index 8aef623..729573a 100644 (file)
--- a/src/sna/kgem.c
+++ b/src/sna/kgem.c
@@ -5841,11 +5841,13 @@ struct kgem_bo *kgem_create_proxy(struct kgem *kgem,
        bo->proxy = kgem_bo_reference(target);
        bo->delta = offset;
 
+       /* Proxies are only tracked for busyness on the current rq */
        if (target->exec && !bo->io) {
+               assert(RQ(target->rq) == kgem->next_request);
                list_move_tail(&bo->request, &kgem->next_request->buffers);
                bo->exec = &_kgem_dummy_exec;
+               bo->rq = target->rq;
        }
-       bo->rq = target->rq;
 
        return bo;
 }

diff --git a/src/sna/kgem.h b/src/sna/kgem.h
index fdabd50..cb0055e 100644 (file)
--- a/src/sna/kgem.h
+++ b/src/sna/kgem.h
@@ -630,6 +630,8 @@ static inline void __kgem_bo_mark_dirty(struct kgem_bo *bo)
             bo->handle, bo->proxy != NULL));
 
        assert(bo->refcnt);
+       assert(bo->exec);
+       assert(bo->rq);
 
        bo->exec->flags |= LOCAL_EXEC_OBJECT_WRITE;
        bo->needs_flush = bo->gpu_dirty = true;