drm/i915: Move __i915_gem_free_object to ttm_bo_destroy

When we implement delayed destroy, we may have a second
call to the delete_mem_notify() handler, while free_object()
only should be called once.

Move it to bo->destroy(), to ensure it's only called once.
This fixes some weird memory corruption issues with delayed
destroy when async eviction is used.

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210830121006.2978297-2-maarten.lankhorst@linux.intel.com
Fixes: 213d509277 ("drm/i915/ttm: Introduce a TTM i915 gem object backend")
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
(cherry picked from commit 48b0961269)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
This commit is contained in:
Maarten Lankhorst 2021-08-30 14:09:48 +02:00 committed by Jani Nikula
parent 2566fffd60
commit f9b23c157a

View File

@ -356,11 +356,8 @@ static void i915_ttm_delete_mem_notify(struct ttm_buffer_object *bo)
{ {
struct drm_i915_gem_object *obj = i915_ttm_to_gem(bo); struct drm_i915_gem_object *obj = i915_ttm_to_gem(bo);
if (likely(obj)) { if (likely(obj))
/* This releases all gem object bindings to the backend. */
i915_ttm_free_cached_io_st(obj); i915_ttm_free_cached_io_st(obj);
__i915_gem_free_object(obj);
}
} }
static struct intel_memory_region * static struct intel_memory_region *
@ -875,8 +872,12 @@ void i915_ttm_bo_destroy(struct ttm_buffer_object *bo)
{ {
struct drm_i915_gem_object *obj = i915_ttm_to_gem(bo); struct drm_i915_gem_object *obj = i915_ttm_to_gem(bo);
/* This releases all gem object bindings to the backend. */
__i915_gem_free_object(obj);
i915_gem_object_release_memory_region(obj); i915_gem_object_release_memory_region(obj);
mutex_destroy(&obj->ttm.get_io_page.lock); mutex_destroy(&obj->ttm.get_io_page.lock);
if (obj->ttm.created) if (obj->ttm.created)
call_rcu(&obj->rcu, __i915_gem_free_object_rcu); call_rcu(&obj->rcu, __i915_gem_free_object_rcu);
} }