[3.11.y.z extended stable] Patch "drm/vmwgfx: Fix regression caused by "drm/ttm: make ttm reservation" has been added to staging queue

[Luis Henriques]

This is a note to let you know that I have just added a patch titled

    drm/vmwgfx: Fix regression caused by "drm/ttm: make ttm reservation

to the linux-3.11.y-queue branch of the 3.11.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.11.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.11.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Luis

------

>From e030e886865574baf3788f91292c4f7fb015d0a0 Mon Sep 17 00:00:00 2001
From: Thomas Hellstrom <thellstrom at vmware.com>
Date: Thu, 30 Jan 2014 10:58:19 +0100
Subject: drm/vmwgfx: Fix regression caused by "drm/ttm: make ttm reservation
 calls behave like reservation calls"

commit cf5e3413337309050c05e13dcebe85b7194a21e5 upstream.

The call to ttm_eu_backoff_reservation() as part of an error path would cause
a lock imbalance if the reservation ticket was not initialized. This error is
easily triggered from user-space by submitting a bogus command stream.

Signed-off-by: Thomas Hellstrom <thellstrom at vmware.com>
Reviewed-by: Jakob Bornecrantz <jakob at vmware.com>
Cc: Maarten Lankhorst <maarten.lankhorst at canonical.com>
Cc: Jerome Glisse <jglisse at redhat.com>
Cc: Dave Airlie <airlied at redhat.com>
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 599f646..8b059eb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -1483,11 +1483,11 @@ int vmw_execbuf_process(struct drm_file *file_priv,
 	ret = vmw_cmd_check_all(dev_priv, sw_context, kernel_commands,
 				command_size);
 	if (unlikely(ret != 0))
-		goto out_err;
+		goto out_err_nores;

 	ret = vmw_resources_reserve(sw_context);
 	if (unlikely(ret != 0))
-		goto out_err;
+		goto out_err_nores;

 	ret = ttm_eu_reserve_buffers(&ticket, &sw_context->validate_nodes);
 	if (unlikely(ret != 0))
@@ -1569,10 +1569,11 @@ int vmw_execbuf_process(struct drm_file *file_priv,
 	return 0;

 out_err:
-	vmw_resource_relocations_free(&sw_context->res_relocations);
-	vmw_free_relocations(sw_context);
 	ttm_eu_backoff_reservation(&ticket, &sw_context->validate_nodes);
+out_err_nores:
 	vmw_resource_list_unreserve(&sw_context->resource_list, true);
+	vmw_resource_relocations_free(&sw_context->res_relocations);
+	vmw_free_relocations(sw_context);
 	vmw_clear_validations(sw_context);
 	if (unlikely(dev_priv->pinned_bo != NULL &&
 		     !dev_priv->query_cid_valid))
--
1.8.3.2