mirror of https://gitee.com/openkylin/linux.git
drm/i915: fix invalid reference handling of the default ctx obj
Otherwise we end up trying to unpin a freed object and BUG. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Reviewed-by: Ben Widawsky <ben@bwidawsk.net> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
This commit is contained in:
parent
eeef9b3874
commit
b259b31206
|
@ -419,8 +419,11 @@ static int do_switch(struct drm_i915_gem_object *from_obj,
|
||||||
from_obj->dirty = 1;
|
from_obj->dirty = 1;
|
||||||
BUG_ON(from_obj->ring != to->ring);
|
BUG_ON(from_obj->ring != to->ring);
|
||||||
i915_gem_object_unpin(from_obj);
|
i915_gem_object_unpin(from_obj);
|
||||||
|
|
||||||
|
drm_gem_object_unreference(&from_obj->base);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
drm_gem_object_reference(&to->obj->base);
|
||||||
ring->last_context_obj = to->obj;
|
ring->last_context_obj = to->obj;
|
||||||
to->is_initialized = true;
|
to->is_initialized = true;
|
||||||
|
|
||||||
|
@ -470,20 +473,7 @@ int i915_switch_context(struct intel_ring_buffer *ring,
|
||||||
if (from_obj == to->obj)
|
if (from_obj == to->obj)
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
ret = do_switch(from_obj, to, i915_gem_next_request_seqno(to->ring));
|
return do_switch(from_obj, to, i915_gem_next_request_seqno(to->ring));
|
||||||
if (ret)
|
|
||||||
return ret;
|
|
||||||
|
|
||||||
/* Just to make the code a little cleaner we take the object reference
|
|
||||||
* after the switch was successful. It would be more intuitive to ref
|
|
||||||
* the 'to' object before the switch but we know the refcount must be >0
|
|
||||||
* if context_get() succeeded, and we hold struct mutex. So it's safe to
|
|
||||||
* do this here/now
|
|
||||||
*/
|
|
||||||
drm_gem_object_reference(&to->obj->base);
|
|
||||||
if (from_obj != NULL)
|
|
||||||
drm_gem_object_unreference(&from_obj->base);
|
|
||||||
return ret;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
int i915_gem_context_create_ioctl(struct drm_device *dev, void *data,
|
int i915_gem_context_create_ioctl(struct drm_device *dev, void *data,
|
||||||
|
|
Loading…
Reference in New Issue