Patch "drm/i915: Hold onto an explicit ref to i915_vma_work.pinned" has been added to the 5.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    drm/i915: Hold onto an explicit ref to i915_vma_work.pinned

to the 5.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-i915-hold-onto-an-explicit-ref-to-i915_vma_work..patch
and it can be found in the queue-5.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 933bb75072aac04a8d2c6eb8b870c89e5eebcc84
Author: Chris Wilson <chris@xxxxxxxxxxxxxxxxxx>
Date:   Mon Nov 2 16:19:31 2020 +0000

    drm/i915: Hold onto an explicit ref to i915_vma_work.pinned
    
    [ Upstream commit 537457a979a02a410b555fab289dcb28b588f33b ]
    
    Since __vma_release is run by a kworker after the fence has been
    signaled, it is no longer protected by the active reference on the vma,
    and so the alias of vw->pinned to vma->obj is also not protected by a
    reference on the object. Add an explicit reference for vw->pinned so it
    will always be safe.
    
    Found by inspection.
    
    Fixes: 54d7195f8c64 ("drm/i915: Unpin vma->obj on early error")
    Reported-by: Tvrtko Ursulin <tvrtko.ursulin@xxxxxxxxx>
    Signed-off-by: Chris Wilson <chris@xxxxxxxxxxxxxxxxxx>
    Cc: Tvrtko Ursulin <tvrtko.ursulin@xxxxxxxxx>
    Cc: <stable@xxxxxxxxxxxxxxx> # v5.6+
    Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@xxxxxxxxx>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201102161931.30031-1-chris@xxxxxxxxxxxxxxxxxx
    (cherry picked from commit bc73e5d33048b7ab5f12b11b5d923700467a8e1d)
    Signed-off-by: Rodrigo Vivi <rodrigo.vivi@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
index bc64f773dcdb4..034d0a8d24c8c 100644
--- a/drivers/gpu/drm/i915/i915_vma.c
+++ b/drivers/gpu/drm/i915/i915_vma.c
@@ -315,8 +315,10 @@ static void __vma_release(struct dma_fence_work *work)
 {
 	struct i915_vma_work *vw = container_of(work, typeof(*vw), base);
 
-	if (vw->pinned)
+	if (vw->pinned) {
 		__i915_gem_object_unpin_pages(vw->pinned);
+		i915_gem_object_put(vw->pinned);
+	}
 }
 
 static const struct dma_fence_work_ops bind_ops = {
@@ -430,7 +432,7 @@ int i915_vma_bind(struct i915_vma *vma,
 
 		if (vma->obj) {
 			__i915_gem_object_pin_pages(vma->obj);
-			work->pinned = vma->obj;
+			work->pinned = i915_gem_object_get(vma->obj);
 		}
 	} else {
 		ret = vma->ops->bind_vma(vma->vm, vma, cache_level, bind_flags);