On Sun, Jul 23, 2023 at 08:43:26PM -0400, Yunxiang Li wrote:
> When the resource is the first in the bulk_move range, adding it again
> (thus moving it to the tail) will corrupt the list since the first
> pointer is not moved. This eventually lead to null pointer deref in
> ttm_lru_bulk_move_del()
>
> Fixes: fee2ede15542 ("drm/ttm: rework bulk move handling v5")
> Signed-off-by: Yunxiang Li <Yunxiang.Li@xxxxxxx>
> Reviewed-by: Christian König <christian.koenig@xxxxxxx>
> CC: stable@xxxxxxxxxxxxxxx
> Link: https://patchwork.freedesktop.org/patch/msgid/20230622141902.28718-3-Yunxiang.Li@xxxxxxx
> Signed-off-by: Christian König <christian.koenig@xxxxxxx>
> (cherry picked from commit 4481913607e58196c48a4fef5e6f45350684ec3c)
> ---
> drivers/gpu/drm/ttm/ttm_resource.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
Both now queued up, thanks.
greg k-h
