From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx07-00376f01.pphosted.com (mx07-00376f01.pphosted.com [185.132.180.163]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7A27E340407 for ; Thu, 11 Jun 2026 05:33:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.132.180.163 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781156023; cv=none; b=ExGYsCCY0UKFGBbNrYFGCQqCZLjy9as41ynEnhS6707eCO5cI7Js9CDVslE4A3iR3QXtqgz4AnAHsxLZ9Q3Qe2NMlIDLri2ARTxuAsfyNKhkPKuqjc/LK16uT81wEwkT8h7AUcDRgSPHzdTvrk25wP2LPt/4oxy+HZRt/TR42YM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781156023; c=relaxed/simple; bh=BPg+FQY9y078Zqh4G0LDWrAQughe1AK3/iOPnr5H6xY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:To:CC; b=H5J7f5fhTTVkD4BUP9+I/kk42I6qw1bmRGwDYSeUOU2wUtwvQmgcFfDi+ZmBKQape8oboG7A6G1FBlxtrz5wH5sTpphoqF2sEsyQ1XzHhbMjIsXY+wWN3cysztK1t1IaU4mnk0hkcvocr2BypKY2z8HgM8oazc6oiCm0jUCW/DE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=imgtec.com; spf=pass smtp.mailfrom=imgtec.com; dkim=pass (2048-bit key) header.d=imgtec.com header.i=@imgtec.com header.b=uofzbDMJ; arc=none smtp.client-ip=185.132.180.163 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=imgtec.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=imgtec.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=imgtec.com header.i=@imgtec.com header.b="uofzbDMJ" Received: from pps.filterd (m0168889.ppops.net [127.0.0.1]) by mx07-00376f01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 65B4qGPR1700676; Thu, 11 Jun 2026 06:33:20 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=imgtec.com; h=cc :content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=dk201812; bh=nnGZcqjCKh92CWb2nIMFbPC Fh6ohzNKTUK3/G9E51fg=; b=uofzbDMJifbggChWuEULhOJi0eBIl6bcCfP1+ZX 2y7eD+m7uFzfcORbDxrvJtMrGMMfE7zjZYIEv+69fUO15rEuEFgZlkQcH/xAMdYD b01VkrTN+beEENtA3x+j/xJ3TtiLwIZvN+3o7+yPYfCCGRAj4Zi5kAkQD1U6EWgg I4ntFqZy0mXhEB9oqjS2m/b3gETcxzKoJxZ18g59EKtVED5XnWKxB6o+J4R79KvV 6okkozR2iVxUgbSn79VTp37wwFy5mYm+k5B4C9Pr3kW+fcAFuwCOh8pm3VejvE6V nle4s3XCtM5xLah4R5vYsUk7A7hLaObmgpRkq3kBOxeH9Ow== Received: from hhmail01.hh.imgtec.org (83-244-153-141.cust-83.exponential-e.net [83.244.153.141]) by mx07-00376f01.pphosted.com (PPS) with ESMTPS id 4epwpph9m8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 11 Jun 2026 06:33:20 +0100 (BST) Received: from [127.0.1.1] (172.25.128.214) by HHMAIL01.hh.imgtec.org (10.100.10.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.37; Thu, 11 Jun 2026 06:33:16 +0100 From: Brajesh Gupta Date: Thu, 11 Jun 2026 11:03:08 +0530 Subject: [PATCH v2] drm/imagination: Fix double call to drm_sched_entity_fini() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-ID: <20260611-b4-sched_fix-v2-1-17a93be86fcd@imgtec.com> X-B4-Tracking: v=1; b=H4sIAJNIKmoC/3WMywqDMBAAf0X23C1JGhV76n8UKcm66h58kEhoE f+9qfceZ2Bmh8hBOMK92CFwkijLnMFcCqDRzQOjdJnBKFOpSiv0FiON3L16eaOjm2+M6m1desj JGjjrc/dsM48StyV8znvSP/tnlDRqpLKpa1ex8pYeMg0b05WWCdrjOL4CvX+XqQAAAA== To: Frank Binns , Matt Coster , Alessio Belle , "Alexandru Dadu" , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Boris Brezillon CC: , , "Brajesh Gupta" X-Mailer: b4 0.13.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1781155996; l=7302; i=brajesh.gupta@imgtec.com; s=20260417; h=from:subject:message-id; bh=BPg+FQY9y078Zqh4G0LDWrAQughe1AK3/iOPnr5H6xY=; b=Juq7DdYCX/gpQadbZfgq+HC74CIx57a2TFW3gKzi/2vNnyrvc2o2xq4haeMe994gUbkFRT15Y mj50Y04zskNBjfocESrNSzRjvC0n4jit4I3Nyx14Z0Nq8VXeVOU6qIp X-Developer-Key: i=brajesh.gupta@imgtec.com; a=ed25519; pk=vDcrSP6vOpWKs914T986xUbB/vY0/cU7mRRb16MRkcg= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjExMDA1MiBTYWx0ZWRfX10xaF/6ySTua RnoS5RvjvWjDviOPGoZHqKhCjh09ryb0VnZweQo10yWM8y8xhEQ53LuFuZR+oIUBouckAZf052m hVxB+SCLhc5Y07CHd1j4jIE4KA+0L4ONGcP2ZwEc44TYSyWknRool48sU7dhJtn++epLmUEpVyA +hTUy52FZwLKkgXJzM0PfUEq1cQkecp40J7jx2/e77duzSaAVZXzI8zr7vCjaSHSX4ckcUqqMiU LBLhvsG9qZYhcEMIWNG8S2X7ndOU+JX0F6jA+EROz8x5g7ozKPXdsp63sogZxYc0yPPYxfXpJEE kf7fCAXtTIHl6yr6YhddEGCoj8AgWabdZ46R2UzwGtevA5CWi8R4XD0dxxb2KBM8i/UB1412Hki 2j/3geWSLqrdrVSiAOb0gOGWZ/PEnH4ZRf0PcLdKilK2eHp2KyWVhznboQrCNjEDiQ/PXqInh3+ KL1+uZMeWbOmhCcXzWA== X-Proofpoint-Spam-Info: AW1haW4tMjYwNjExMDA1MiBTYWx0ZWRfX1JHiiBy2RC+I S/nsvVJMJEttwbR/NRtK6Jju9uTE7PmggRKDGxcz18KubVYO7Gz9jszhbWalo3aEu54LmTJDT98 Zh0ElSYTUgEb6X0TFBTIlHl4bF5FInI= X-Proofpoint-GUID: JGfRvzjqU6eufzzX9sVoUvakz4egqL9v X-Authority-Analysis: v=2.4 cv=K5oS2SWI c=1 sm=1 tr=0 ts=6a2a48a0 cx=c_pps a=AKOq//PuzOIrVTIF9yBwbA==:117 a=AKOq//PuzOIrVTIF9yBwbA==:17 a=aRQ8HefCnzIA:10 a=IkcTkHD0fZMA:10 a=FelO9ux0wxsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=kQ-hrUj2-E3RCbRHssb7:22 a=7RYWX5rxfSByPNLylY2M:22 a=VwQbUJbxAAAA:8 a=r_1tXGB3AAAA:8 a=Wf2FQp8mk3ujYxj49eQA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=t8nPyN_e6usw4ciXM-Pk:22 X-Proofpoint-ORIG-GUID: JGfRvzjqU6eufzzX9sVoUvakz4egqL9v Call sequence of double call: pvr_context_destroy   pvr_context_kill_queues     pvr_queue_kill       drm_sched_entity_destroy         drm_sched_entity_fini // here   pvr_context_put     kref_put(..., pvr_context_release)       pvr_context_destroy_queues         pvr_queue_destroy           drm_sched_entity_fini // here Call to drm_sched_entity_destroy() from pvr_context_kill_queues() calls drm_sched_entity_flush() + drm_sched_entity_fini(). drm_sched_entity_flush() ensures all pending jobs are completed and drm_sched_entity_fini() ensures no further submission is allowed as per expectation from pvr_context_kill_queues(). Drop the extra call to drm_sched_entity_fini(). Stack trace for issue with addition of refcounting for DRM entity stats in commit fd177135f0e6 ("drm/sched: Account entity GPU time"): [ 789.490527] ------------[ cut here ]------------ [ 789.490559] refcount_t: underflow; use-after-free. [ 789.490657] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xf4/0x144, CPU#0: kworker/u16:1/440 [ 789.490695] Modules linked in: powervr drm_gpuvm drm_exec gpu_sched drm_shmem_helper xhci_plat_hcd xhci_hcd dwc3 usbcore usb_common snd_soc_simple_card snd_soc_simple_card_utils sa2ul sha512 sha256 dwc3_am62 sha1 authenc rti_wdt libsha512 at24 sch_fq_codel fuse dm_mod ipv6 [ 789.490798] CPU: 0 UID: 0 PID: 440 Comm: kworker/u16:1 Not tainted 7.0.0-rc7-02049-g5e2c0700091b #22 PREEMPT [ 789.490809] Hardware name: Texas Instruments AM625 SK (DT) [ 789.490815] Workqueue: powervr-sched pvr_queue_fence_release_work [powervr] [ 789.490868] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 789.490876] pc : refcount_warn_saturate+0xf4/0x144 [ 789.490884] lr : refcount_warn_saturate+0xf4/0x144 [ 789.490892] sp : ffff8000822cbcc0 [ 789.490895] x29: ffff8000822cbcc0 x28: 0000000000000000 x27: 0000000000000000 [ 789.490909] x26: 0000000000000000 x25: ffff800081b1e338 x24: ffff000004541405 [ 789.490922] x23: ffff000004bea950 x22: ffff00000042e400 x21: ffff000007123e30 [ 789.490935] x20: ffff000007123000 x19: ffff000007a80d50 x18: fffffffffffe7768 [ 789.490948] x17: 74736574202c6e6f x16: 697461746e656d65 x15: ffff800081b269f0 [ 789.490962] x14: 0000000000000030 x13: ffff800081b26a70 x12: 0000000000000211 [ 789.490975] x11: 00000000000000c0 x10: 0000000000000b50 x9 : ffff8000822cbb30 [ 789.490988] x8 : ffff0000014e7bb0 x7 : ffff00007725e780 x6 : 0000000372a05f49 [ 789.491001] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000010 [ 789.491013] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000014e7000 [ 789.491027] Call trace: [ 789.491032] refcount_warn_saturate+0xf4/0x144 (P) [ 789.491043] drm_sched_entity_fini+0x164/0x18c [gpu_sched] [ 789.491081] pvr_queue_destroy+0x64/0x134 [powervr] [ 789.491110] pvr_context_destroy_queues+0x34/0x64 [powervr] [ 789.491138] pvr_context_release+0x70/0xac [powervr] [ 789.491166] pvr_context_put.part.0+0x5c/0x7c [powervr] [ 789.491193] pvr_context_put+0x14/0x24 [powervr] [ 789.491221] pvr_queue_fence_release_work+0x20/0x38 [powervr] [ 789.491249] process_one_work+0x160/0x4c4 [ 789.491264] worker_thread+0x188/0x310 [ 789.491276] kthread+0x130/0x13c [ 789.491287] ret_from_fork+0x10/0x20 [ 789.491300] ---[ end trace 0000000000000000 ]--- Signed-off-by: Brajesh Gupta Fixes: eaf01ee5ba28 ("drm/imagination: Implement job submission and scheduling") References: fd177135f0e6 ("drm/sched: Account entity GPU time") --- Changes in v2: - Fixed memory leak identified in following error path handling of pvr_context_create(): - pvr_context_create() - ... - err_destroy_queues: - pvr_context_destroy_queues() - pvr_queue_destroy() - Link to v1: https://lore.kernel.org/r/20260610-b4-sched_fix-v1-1-c5977a6e0b4c@imgtec.com --- drivers/gpu/drm/imagination/pvr_context.c | 23 +++++++++++++++++++---- drivers/gpu/drm/imagination/pvr_queue.c | 1 - 2 files changed, 19 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/imagination/pvr_context.c b/drivers/gpu/drm/imagination/pvr_context.c index eba4694400b5..f11a45d04632 100644 --- a/drivers/gpu/drm/imagination/pvr_context.c +++ b/drivers/gpu/drm/imagination/pvr_context.c @@ -161,21 +161,36 @@ ctx_fw_data_init(void *cpu_ptr, void *priv) /** * pvr_context_destroy_queues() - Destroy all queues attached to a context. * @ctx: Context to destroy queues on. + * @queue_entity_fini: Corresponding queues of context to be released for + * failure path in context creation. * * Should be called when the last reference to a context object is dropped. * It releases all resources attached to the queues bound to this context. */ -static void pvr_context_destroy_queues(struct pvr_context *ctx) +static void pvr_context_destroy_queues(struct pvr_context *ctx, bool queue_entity_fini) { switch (ctx->type) { case DRM_PVR_CTX_TYPE_RENDER: + if (queue_entity_fini) { + drm_sched_entity_fini(&ctx->queues.fragment->entity); + drm_sched_entity_fini(&ctx->queues.geometry->entity) + } + pvr_queue_destroy(ctx->queues.fragment); pvr_queue_destroy(ctx->queues.geometry); break; + case DRM_PVR_CTX_TYPE_COMPUTE: + if (queue_entity_fini) + drm_sched_entity_fini(&ctx->queues.compute->entity); + pvr_queue_destroy(ctx->queues.compute); break; + case DRM_PVR_CTX_TYPE_TRANSFER_FRAG: + if (queue_entity_fini) + drm_sched_entity_fini(&ctx->queues.transfer->entity); + pvr_queue_destroy(ctx->queues.transfer); break; } @@ -240,7 +255,7 @@ static int pvr_context_create_queues(struct pvr_context *ctx, return -EINVAL; err_destroy_queues: - pvr_context_destroy_queues(ctx); + pvr_context_destroy_queues(ctx, false); return err; } @@ -349,7 +364,7 @@ int pvr_context_create(struct pvr_file *pvr_file, struct drm_pvr_ioctl_create_co pvr_fw_object_destroy(ctx->fw_obj); err_destroy_queues: - pvr_context_destroy_queues(ctx); + pvr_context_destroy_queues(ctx, true); err_free_ctx_id: /* @@ -384,7 +399,7 @@ pvr_context_release(struct kref *ref_count) spin_unlock(&pvr_dev->ctx_list_lock); xa_erase(&pvr_dev->ctx_ids, ctx->ctx_id); - pvr_context_destroy_queues(ctx); + pvr_context_destroy_queues(ctx, false); pvr_fw_object_destroy(ctx->fw_obj); kfree(ctx->data); pvr_vm_context_put(ctx->vm_ctx); diff --git a/drivers/gpu/drm/imagination/pvr_queue.c b/drivers/gpu/drm/imagination/pvr_queue.c index 7ed60e1c1a86..c163f8da2106 100644 --- a/drivers/gpu/drm/imagination/pvr_queue.c +++ b/drivers/gpu/drm/imagination/pvr_queue.c @@ -1453,7 +1453,6 @@ void pvr_queue_destroy(struct pvr_queue *queue) mutex_unlock(&queue->ctx->pvr_dev->queues.lock); drm_sched_fini(&queue->scheduler); - drm_sched_entity_fini(&queue->entity); if (WARN_ON(queue->last_queued_job_scheduled_fence)) dma_fence_put(queue->last_queued_job_scheduled_fence); --- base-commit: 61de054a772a1feda6364931ab1baf9038abf1c8 change-id: 20260610-b4-sched_fix-ac3b920f475b Best regards, -- Brajesh Gupta