dma-buf: fix reservation_object_wait_timeout_rcu once more v2

BugLink: http://bugs.launchpad.net/bugs/1751131
commit 5bffee867df7494ecd32c1e6ec4e8fc934c521b7 upstream.

We need to set shared_count even if we already have a fence to wait for.

v2: init i to -1 as well

Signed-off-by: Christian König <christian.koenig@amd.com>
Cc: stable@vger.kernel.org
Tested-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180122200003.6665-1-christian.koenig@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c
index b44d9d7db347b4e4dcbad7d96c40f3e4af36a477..012fa3d1f407f47dad0c14328b4ed4e6d10100ff 100644 (file)
--- a/drivers/dma-buf/reservation.c
+++ b/drivers/dma-buf/reservation.c
@@ -455,13 +455,15 @@ long reservation_object_wait_timeout_rcu(struct reservation_object *obj,
                                         unsigned long timeout)
 {
        struct dma_fence *fence;
-       unsigned seq, shared_count, i = 0;
+       unsigned seq, shared_count;
        long ret = timeout ? timeout : 1;
+       int i;
 
 retry:
        shared_count = 0;
        seq = read_seqcount_begin(&obj->seq);
        rcu_read_lock();
+       i = -1;
 
        fence = rcu_dereference(obj->fence_excl);
        if (fence && !test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags)) {
@@ -477,14 +479,14 @@ retry:
                fence = NULL;
        }
 
-       if (!fence && wait_all) {
+       if (wait_all) {
                struct reservation_object_list *fobj =
                                                rcu_dereference(obj->fence);
 
                if (fobj)
                        shared_count = fobj->shared_count;
 
-               for (i = 0; i < shared_count; ++i) {
+               for (i = 0; !fence && i < shared_count; ++i) {
                        struct dma_fence *lfence = rcu_dereference(fobj->shared[i]);
 
                        if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT,