From patchwork Fri Jan 26 10:22:25 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: AceLan Kao X-Patchwork-Id: 1891235 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4TLv0451bSz23fD for ; Fri, 26 Jan 2024 21:22:44 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1rTJM5-0007kU-QN; Fri, 26 Jan 2024 10:22:38 +0000 Received: from mail-pf1-f178.google.com ([209.85.210.178]) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1rTJLz-0007jc-BK for kernel-team@lists.ubuntu.com; Fri, 26 Jan 2024 10:22:31 +0000 Received: by mail-pf1-f178.google.com with SMTP id d2e1a72fcca58-6da4a923b1bso97450b3a.2 for ; Fri, 26 Jan 2024 02:22:31 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706264549; x=1706869349; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:sender:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=0HJ5vgCBqyQ7X5g9OmfHL74Fun/0XzxByanUnuj62Ig=; b=mJm2mPCwj2F3d1eOHsKqX8yygHk8vBC4u44ThBKkSefk6tkgmLyHZQ33J2vGqqTy3b qeTpNNsxmiB0jIgp0LEQNSZueCiiQIGB61xK+/tijK1AvNSt9ZniDZBNfxwgD36DMrjD ggkzGab2Xj+ew7135HN7eqFT348932m4UH+LKi+++eRmQWVXTjWmCVoN6xjjw8aQT8ul hEMsv0p2pw2UMiZgyI644g/Lze30asr91yRGkJ3KVxbs0yIOEenBW6tb2xSCihOHRiRF OeM3CB1tXcUvCcmDhaX9grZpw8wwt6MKsWNH5gqTyCHF3f74FCgss0B5VIa9l09xnomb TcKw== X-Gm-Message-State: AOJu0Yzl1oGZPwNoPExrq9MFyklVebIfne5ZYdpsbkFzxzhttllJKZsq +KuCFRYnpll9EakHSn5nZ4SbOoPwFP2oQoVMO0onQlCAkKtT9ECS5jCtOM+i7oE= X-Google-Smtp-Source: AGHT+IFFv0+hKiKplfNjU0wHK9U/Jm67FRKjGcVJ/uZhe+r8mBId7tXELh7ihOxpH9b6EXT7A4A7Ng== X-Received: by 2002:a05:6a20:a12c:b0:199:d6b3:d876 with SMTP id q44-20020a056a20a12c00b00199d6b3d876mr888957pzk.37.1706264549330; Fri, 26 Jan 2024 02:22:29 -0800 (PST) Received: from localhost (220-135-95-34.hinet-ip.hinet.net. [220.135.95.34]) by smtp.gmail.com with ESMTPSA id d3-20020aa78683000000b006ddc14c416dsm832982pfo.95.2024.01.26.02.22.28 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Jan 2024 02:22:29 -0800 (PST) From: AceLan Kao To: kernel-team@lists.ubuntu.com Subject: [PATCH 1/1][SRU][M] drm/ttm: Reorder sys manager cleanup step Date: Fri, 26 Jan 2024 18:22:25 +0800 Message-Id: <20240126102225.151471-2-acelan.kao@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240126102225.151471-1-acelan.kao@canonical.com> References: <20240126102225.151471-1-acelan.kao@canonical.com> MIME-Version: 1.0 Received-SPF: pass client-ip=209.85.210.178; envelope-from=acelan@gmail.com; helo=mail-pf1-f178.google.com X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Karolina Stolarek BugLink: https://bugs.launchpad.net/bugs/2051341 With the current cleanup flow, we could trigger a NULL pointer dereference if there is a delayed destruction of a BO with a system resource that gets executed on drain_workqueue() call, as we attempt to free a resource using an already released resource manager. Remove the device from the device list and drain its workqueue before releasing the system domain manager in ttm_device_fini(). Signed-off-by: Karolina Stolarek Reviewed-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20231016121525.2237838-1-karolina.stolarek@intel.com Signed-off-by: Christian König (cherry picked from commit 3b401e30c249849d803de6c332dad2a595a58658) Signed-off-by: Chia-Lin Kao (AceLan) --- drivers/gpu/drm/ttm/ttm_device.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/ttm/ttm_device.c b/drivers/gpu/drm/ttm/ttm_device.c index 7726a72befc5..d48b39132b32 100644 --- a/drivers/gpu/drm/ttm/ttm_device.c +++ b/drivers/gpu/drm/ttm/ttm_device.c @@ -232,10 +232,6 @@ void ttm_device_fini(struct ttm_device *bdev) struct ttm_resource_manager *man; unsigned i; - man = ttm_manager_type(bdev, TTM_PL_SYSTEM); - ttm_resource_manager_set_used(man, false); - ttm_set_driver_manager(bdev, TTM_PL_SYSTEM, NULL); - mutex_lock(&ttm_global_mutex); list_del(&bdev->device_list); mutex_unlock(&ttm_global_mutex); @@ -243,6 +239,10 @@ void ttm_device_fini(struct ttm_device *bdev) drain_workqueue(bdev->wq); destroy_workqueue(bdev->wq); + man = ttm_manager_type(bdev, TTM_PL_SYSTEM); + ttm_resource_manager_set_used(man, false); + ttm_set_driver_manager(bdev, TTM_PL_SYSTEM, NULL); + spin_lock(&bdev->lru_lock); for (i = 0; i < TTM_MAX_BO_PRIORITY; ++i) if (list_empty(&man->lru[0]))