On Wed, Dec 02, 2015 at 09:13:46AM +0000, Chris Wilson wrote: > In commit 2e1b873072dfe3bbcc158a9c21acde1ab0d36c55 [v4.2] > Author: Chris Wilson <chris@xxxxxxxxxxxxxxxxxx> > Date: Mon Apr 27 13:41:22 2015 +0100 > > drm/i915: Convert RPS tracking to a intel_rps_client struct > > we converted the __i915_wait_request() to take a new intel_rps_client > struct (rather than having to pass fake drm_i915_file_private structs). > However, due to use of passing a void pointer, I didn't spot one > callsite in wait-ioctl was passing the wrong pointer. > > Signed-off-by: Chris Wilson <chris@xxxxxxxxxxxxxxxxxx> > Cc: Daniel Vetter <daniel.vetter@xxxxxxxx> > Cc: stable@xxxxxxxxxxxxxxx Fwiw, the impact of this bug is zero. Along the rps path, we always first call list_empty(rps) which when we pass in the wrong pointer always evaluates to false and we return early and never chase the invalid pointers. The user visible impact is then wait-ioctl doesn't get the same waitboosting as the other interfaces (set-domain, throttle), which is a performance concern for the *very* few users of the wait interface. There is also a libdrm_intel patch to use the wait-ioctl for drm_intel_bo_wait_rendering() if anyone feels inclined to review libdrm_intel patches. -Chris -- Chris Wilson, Intel Open Source Technology Centre -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html