Hi, Matt,

Thanks for reviewing.

On 9/7/21 7:37 PM, Matthew Auld wrote:

+    i915_gem_ww_unlock_single(backup);
+    i915_gem_object_put(backup);

I assume we need to set ttm.backup = NULL somewhere here on the failure path, or don't drop the ref? Or at least it looks like potential uaf later?

Yes, I think on failure, we just don't drop the ref here in case something at some point decides to retry.

I'll fix up this and other comments.

/Thomas



+
+    return err;
+}
+

Reply via email to