From: jsg <jsg@openbsd.org>
Date: Fri, 28 Jul 2023 06:48:41 +0000 (+0000)
Subject: drm/ttm: fix bulk_move corruption when adding a entry
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=0774dd8a0da704d06f443498ec83085066189e39;p=openbsd

drm/ttm: fix bulk_move corruption when adding a entry

From Yunxiang Li
70a3015683b007a0db4a1e858791b69afd45fc83 in linux-6.1.y/6.1.42
4481913607e58196c48a4fef5e6f45350684ec3c in mainline linux
---

diff --git a/sys/dev/pci/drm/ttm/ttm_resource.c b/sys/dev/pci/drm/ttm/ttm_resource.c
index 8b31e8d2015..802a724f666 100644
--- a/sys/dev/pci/drm/ttm/ttm_resource.c
+++ b/sys/dev/pci/drm/ttm/ttm_resource.c
@@ -85,6 +85,8 @@ static void ttm_lru_bulk_move_pos_tail(struct ttm_lru_bulk_move_pos *pos,
 				       struct ttm_resource *res)
 {
 	if (pos->last != res) {
+		if (pos->first == res)
+			pos->first = list_next_entry(res, lru);
 		list_move(&res->lru, &pos->last->lru);
 		pos->last = res;
 	}
@@ -110,7 +112,8 @@ static void ttm_lru_bulk_move_del(struct ttm_lru_bulk_move *bulk,
 {
 	struct ttm_lru_bulk_move_pos *pos = ttm_lru_bulk_move_pos(bulk, res);
 
-	if (unlikely(pos->first == res && pos->last == res)) {
+	if (unlikely(WARN_ON(!pos->first || !pos->last) ||
+		     (pos->first == res && pos->last == res))) {
 		pos->first = NULL;
 		pos->last = NULL;
 	} else if (pos->first == res) {