diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2023-10-05 22:57:34 +0200 |
|---|---|---|
| committer | Kalle Valo <kvalo@kernel.org> | 2023-10-06 17:08:47 +0300 |
| commit | 7d6904bf26b96ef087514cb7a8c50b62a4911c99 (patch) | |
| tree | 2feaff8495d88c2102dc2e017b7afc5c58db02d6 /drivers/dma-buf/sw_sync.c | |
| parent | 9418edf8ff01e7a4904aac1aca4864ecdea37593 (diff) | |
| parent | 22061bfc57fe08c77141dc876b4af75603c4d61d (diff) | |
Merge wireless into wireless-next
Resolve several conflicts, mostly between changes/fixes in
wireless and the locking rework in wireless-next. One of
the conflicts actually shows a bug in wireless that we'll
want to fix separately.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Diffstat (limited to 'drivers/dma-buf/sw_sync.c')
| -rw-r--r-- | drivers/dma-buf/sw_sync.c | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c index 63f0aeb66db6..f0a35277fd84 100644 --- a/drivers/dma-buf/sw_sync.c +++ b/drivers/dma-buf/sw_sync.c @@ -191,6 +191,7 @@ static const struct dma_fence_ops timeline_fence_ops = { */ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc) { + LIST_HEAD(signalled); struct sync_pt *pt, *next; trace_sync_timeline(obj); @@ -203,21 +204,20 @@ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc) if (!timeline_fence_signaled(&pt->base)) break; - list_del_init(&pt->link); + dma_fence_get(&pt->base); + + list_move_tail(&pt->link, &signalled); rb_erase(&pt->node, &obj->pt_tree); - /* - * A signal callback may release the last reference to this - * fence, causing it to be freed. That operation has to be - * last to avoid a use after free inside this loop, and must - * be after we remove the fence from the timeline in order to - * prevent deadlocking on timeline->lock inside - * timeline_fence_release(). - */ dma_fence_signal_locked(&pt->base); } spin_unlock_irq(&obj->lock); + + list_for_each_entry_safe(pt, next, &signalled, link) { + list_del_init(&pt->link); + dma_fence_put(&pt->base); + } } /** |