drm/xe: skip rebind_list if vma destroyed

If we are closing a vm, mark each vma as XE_VMA_DESTROYED and skip
touching the rebind_list if this is seen on the eviction path. That way
we can safely drop the vm dma-resv lock on the close path without
needing to worry about racing with the eviction path trying to add stuff
to the rebind_list which can corrupt our contended list, since the
destroy and rebind links are the same list entry underneath.

References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/514
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

drivers/gpu/drm/xe/xe_bo.c

@@ -506,15 +506,17 @@ static int xe_bo_trigger_rebind(struct xe_device *xe, struct xe_bo *bo,
 				vm_resv_locked = true;
 			else if (ctx->resv != xe_vm_resv(vm)) {
 				spin_lock(&vm->notifier.list_lock);
-				list_move_tail(&vma->notifier.rebind_link,
-					       &vm->notifier.rebind_list);
+				if (!(vma->gpuva.flags & XE_VMA_DESTROYED))
+					list_move_tail(&vma->notifier.rebind_link,
+						       &vm->notifier.rebind_list);
 				spin_unlock(&vm->notifier.list_lock);
 				continue;
 			}
 
 			xe_vm_assert_held(vm);
-			if (list_empty(&vma->combined_links.rebind) &&
-			    vma->tile_present)
+			if (vma->tile_present &&
+			    !(vma->gpuva.flags & XE_VMA_DESTROYED) &&
+			    list_empty(&vma->combined_links.rebind))
 				list_add_tail(&vma->combined_links.rebind,
 					      &vm->rebind_list);
 

drivers/gpu/drm/xe/xe_vm.c

@@ -1460,6 +1460,7 @@ void xe_vm_close_and_put(struct xe_vm *vm)
 		}
 
 		list_move_tail(&vma->combined_links.destroy, &contested);
+		vma->gpuva.flags |= XE_VMA_DESTROYED;
 	}
 
 	/*