mirror of
https://github.com/torvalds/linux.git
synced 2024-12-27 21:33:00 +00:00
6e068270b7
When we call intel_engine_cancel_signaling() to stop reporting when a request is completed via an asynchronous signal, we remove that request from the breadcrumb wait queue. However, we may be concurrently processing that request in the signaler itself, the actual operations on the request's node itself are serialised but we do not actually clear the waiter after removing it from the tree allowing both parties to attempt to do so and corrupting the rbtree. (Previously removing from the breadcrumb wait queue could only be done on behalf of i915_wait_request, so this race could not happen). Reported-by: "He, Bo" <bo.he@intel.com> Fixes: |
||
---|---|---|
.. | ||
drm | ||
host1x | ||
ipu-v3 | ||
vga | ||
Makefile |