Fix crash on Xwayland using nouveau

dma-buf-fix-reservation_object_wait_timeout_rcu-once-more-v2.patch

@@ -0,0 +1,62 @@
+From patchwork Mon Jan 22 20:00:03 2018
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+Subject: dma-buf: fix reservation_object_wait_timeout_rcu once more v2
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <ckoenig.leichtzumerken@gmail.com>
+X-Patchwork-Id: 199865
+Message-Id: <20180122200003.6665-1-christian.koenig@amd.com>
+To: dri-devel@lists.freedesktop.org, chris@chris-wilson.co.uk, lyude@redhat.com
+Date: Mon, 22 Jan 2018 21:00:03 +0100
+
+We need to set shared_count even if we already have a fence to wait for.
+
+v2: init i to -1 as well
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Cc: stable@vger.kernel.org
+Tested-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+---
+ drivers/dma-buf/reservation.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c
+index 461afa9febd4..314eb1071cce 100644
+--- a/drivers/dma-buf/reservation.c
++++ b/drivers/dma-buf/reservation.c
+@@ -484,13 +484,15 @@ long reservation_object_wait_timeout_rcu(struct reservation_object *obj,
+ 					 unsigned long timeout)
+ {
+ 	struct dma_fence *fence;
+-	unsigned seq, shared_count, i = 0;
++	unsigned seq, shared_count;
+ 	long ret = timeout ? timeout : 1;
++	int i;
+ 
+ retry:
+ 	shared_count = 0;
+ 	seq = read_seqcount_begin(&obj->seq);
+ 	rcu_read_lock();
++	i = -1;
+ 
+ 	fence = rcu_dereference(obj->fence_excl);
+ 	if (fence && !test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags)) {
+@@ -506,14 +508,14 @@ long reservation_object_wait_timeout_rcu(struct reservation_object *obj,
+ 		fence = NULL;
+ 	}
+ 
+-	if (!fence && wait_all) {
++	if (wait_all) {
+ 		struct reservation_object_list *fobj =
+ 						rcu_dereference(obj->fence);
+ 
+ 		if (fobj)
+ 			shared_count = fobj->shared_count;
+ 
+-		for (i = 0; i < shared_count; ++i) {
++		for (i = 0; !fence && i < shared_count; ++i) {
+ 			struct dma_fence *lfence = rcu_dereference(fobj->shared[i]);
+ 
+ 			if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT,

kernel.spec

@@ -642,6 +642,8 @@ Patch641: 0001-Bluetooth-btusb-Disable-autosuspend-on-QCA-Rome-devi.patch
 # Speculative Execution patches
 Patch642: prevent-bounds-check-bypass-via-speculative-execution.patch
 
+# Fix crash on Xwayland using nouveau
+Patch650: dma-buf-fix-reservation_object_wait_timeout_rcu-once-more-v2.patch
 
 # END OF PATCH DEFINITIONS
 
@@ -1901,6 +1903,9 @@ fi
 #
 #
 %changelog
+* Fri Jan 26 2018 Justin M. Forbes <jforbes@fedoraproject.org>
+- Fix crash on Xwayland using nouveau
+
 * Fri Jan 26 2018 Laura Abbott <labbott@redhat.com> - 4.15.0-0.rc9.git4.1
 - Linux v4.15-rc9-67-g993ca2068b04