From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f45.google.com (mail-ed1-f45.google.com [209.85.208.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6B7E33DA7E2 for ; Thu, 18 Jun 2026 14:03:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781791431; cv=none; b=UU3q5JpANT5yZzJBXTdTI29ebf1JFEubjDka0RmY84dl4QDhpS64j+POdyOOLUD8F2lyUNRc/8Y0wkf4XXxsXgemX6EvGitdoTypARfcr4a+joCSb7X7g0IElzHL8tzGqOas8Pw00/WEc72wy7QGAjyCgX6Y7ReRa1GwEqVdhn8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781791431; c=relaxed/simple; bh=qhEuDvxbvFGKiILbgKF1Dlzmaqyw2vxAjNs3wRQ+fVs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=SxuoAygWKr3oo8cI07j0W6hjdFBUxQk3VXjik0oUZgB+3uqfIHRjVt/CV/DPmVnN8ZN/VImQg3Sn8g6nEJ17p2L6NXMAAygQWj+XU4nDKh69MgR/MY5TbsOHhCvbz/lIe39Yq1jbFlfDp6ADMAGuOtkaQ5zfqNGSoSzLodOGFiQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=aDkDEu1v; arc=none smtp.client-ip=209.85.208.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="aDkDEu1v" Received: by mail-ed1-f45.google.com with SMTP id 4fb4d7f45d1cf-6958372b199so1601329a12.3 for ; Thu, 18 Jun 2026 07:03:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1781791429; x=1782396229; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=38plZ0uTNBbwKeBUJYWbAXFzzu4qCG2nojxXWDV02QY=; b=aDkDEu1vsfwKr1BczLlSaQqwkHs+7emE0uJ2bu7peZaFyT3sqob70xCri+qpu2MnN2 pEQ3cAmzewiXcpZAt0mHqR5hXgn3mX+pDOnmUo7FRP1iluahGWcxwtQARka4M0GnxYBg Tw6tmBfVr5zanno89M2cDZqrng7wpWxcDaef7e3XpQZWM6vaGBpqklcHpTfzb+69zZ7f Fq16hJtGfz3PZXe8hr0yNy978MDBc7ugDZk3fB85GiMUbR5XklkOyu9UMMLmp4ro05AX z8J/9gZG1iwSQCSF4T5HhyGpGrqYiXHkEL1/T4ydkpirJur3qwYXQbsrNrrHcVl3yb0T uZXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781791429; x=1782396229; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=38plZ0uTNBbwKeBUJYWbAXFzzu4qCG2nojxXWDV02QY=; b=DE0wzWZHrD0CQRg58gT8H0hRDvaXh0EgbLdie9pAMHlLJot+tXiVcwIlHCe504XJOo H4YMCoSc5WdlnH3uiZuHzVO9FC1OHOGb9XABFCCHu6KppVgjPBAs8D8K86pKBAi2gd0l k8WLFIjntQVycJV1OUeXZPVpygUxFgKJe7woH11SFLZE/+9Q+lQeNrd1x+Rfb/6+dXA0 xOtJ7Sn6PUF4aLtXQISzSOu8zzeGJ0g3Stb2VAQmA6ldTtFAhJRZh2TnOXJMMNqQSIr3 Yi89y36vcKnHFyBH7exn/DX1glUA94BWDFeFCfDIia8EtnCdpWcglHcONnnj/hBbTQFj 6CXQ== X-Forwarded-Encrypted: i=1; AFNElJ+CtsSMxCKpzDMcHFpb6RPuNVnf9ED2wgtPtn5M7bb2YkenXTx1aPDO0osJx7HY6bVhbouokEtv77cui9M=@vger.kernel.org X-Gm-Message-State: AOJu0YxM62nwn2U8qGDCS8FR9O4BLSykskqZslHxTjQMGzKfCS0i8d9W yceV/I+PDmipjN1jZqs/MOEl9cYjnAQcgB45eBgKSyw7MvQaWbYhhn5U/UVJXR+3Gtw= X-Gm-Gg: AfdE7cnJKMqYQ3emlGxhBBAteB1Rg38eOlzgFILNKy+XUWSRTxSH+8VztlTClq47Ek4 z+9BwMybWZKiKsqHjZaae6mOsUvG19CJvNoK6uTXWUv/iVQjh1ezgs7eBNBzxvy27p+gzgrA9TT /ROGi1+yBmRcFEE6fLFHMTT9U1acqeCvURQkRZGV3x02s0tBnxxiwCSagFElkZ/AazMI3aUCyZx hFDrU0ZsXykNVFaa+t43VSVdZbyt00Kcng6wWuOjCOXw7Dbho3ebKqgPz0IAEhMp9ojdaO6r6O1 MPXMs7RPtEm/cm78F0iFVCbfBY5xwuQJiG5OdUfOwLfwKg3Cm6tDBord1zDt3Y85q78CFlVmlAc wYQHYC4Se9h2ToBcZHh4hgVNmyUiNyZE046oZlt7AFXxUuJ/6TQikXAdYY6pqoK+Tq1lSpRlbAI Vf0HxevldjB1foWlkT0w8E6jYoM7eJJQZvlvM+cgHQSVGU9RTXfy+IxqjC41D2o8F9qdzhrHGqt srczfA= X-Received: by 2002:a17:907:970f:b0:c05:8586:da12 with SMTP id a640c23a62f3a-c07c81d1871mr124087466b.50.1781791428476; Thu, 18 Jun 2026 07:03:48 -0700 (PDT) Received: from puffmais2.c.googlers.com (181.179.204.35.bc.googleusercontent.com. [35.204.179.181]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-bfdb9014501sm973334366b.60.2026.06.18.07.03.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 18 Jun 2026 07:03:47 -0700 (PDT) From: =?utf-8?q?Andr=C3=A9_Draszik?= Date: Thu, 18 Jun 2026 15:03:45 +0100 Subject: [PATCH] drm/drm_crtc: fix race with dma_fence_signal() in ::get_driver_name() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20260618-linux-drm_crtc_fix2-v1-1-c03e77b36f34@linaro.org> X-B4-Tracking: v=1; b=H4sIAMD6M2oC/x2M7QpAQBAAX0X725Xb85VXkXSdxRZHe0jJu7v8n KmZBwIJU4AmeUDo4sCbj6DTBNxs/USKh8iAGZZZqWu1sD9vNcjaOzlcP/KNCo2tnClym2uEWO5 C0f/XtnvfD1Lv8uZlAAAA X-Change-ID: 20260618-linux-drm_crtc_fix2-23a7c354a412 To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Sumit Semwal , =?utf-8?q?Christian_K=C3=B6nig?= , Tvrtko Ursulin , Boris Brezillon , Philipp Stanner Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, linaro-mm-sig@lists.linaro.org, Peter Griffin , Tudor Ambarus , Juan Yescas , kernel-team@android.com, =?utf-8?q?Andr=C3=A9_Draszik?= X-Mailer: b4 0.14.3 Since commit 541c8f2468b9 ("dma-buf: detach fence ops on signal v3"), I'm seeing the BUG_ON() triggering in drm_crtc's fence_to_crtc() via drm_crtc_fence_get_driver_name() regularly: Call trace: panic+0x58/0x5c die+0x160/0x178 bug_brk_handler+0x70/0xa4 call_el1_break_hook+0x3c/0x1a0 do_el1_brk64+0x24/0x74 el1_brk64+0x34/0x54 el1h_64_sync_handler+0x80/0xfc el1h_64_sync+0x84/0x88 drm_crtc_fence_get_driver_name+0x60/0x68 (P) sync_file_get_name+0x184/0x45c sync_file_ioctl+0x404/0xf70 __arm64_sys_ioctl+0x124/0x1dc This looks to be caused by a code flow similar to the following: +++ snip +++ thread A thread B ioctl(SYNC_IOC_FILE_INFO) sync_file_ioctl() sync_file_get_name() dma_fence_signal_timestamp_locked() dma_fence_driver_name() ops = rcu_dereference(fence->ops) if (!dma_fence_test_signaled_flag()) ops->get_driver_name(fence) i.e. drm_crtc_fence_get_driver_name() test_and_set_bit(SIGNALED) RCU_INIT_POINTER(fence->ops, NULL) drm_crtc_fence_get_driver_name() BUG_ON(rcu_access_pointer(fence->ops) != &drm_crtc_fence_ops) +++ snap +++ I see two ways to resolve this: a) simply drop the BUG_ON(). It can not work anymore since above commit, as it is racy now. b) pass the original 'ops' pointer obtained in dma_fence_driver_name() to all callees. This patch implements option a), as because: * I don't see much benefit in passing the extra pointer just for this BUG_ON() to work. * Requiring the dma_fence_ops in those callbacks is an implementation detail of the drm_crtc driver, and therefore upper layers shouldn't have to care about that. * The existence of the BUG_ON() doesn't appear to be consistent with implementations of ::get_driver_name() or ::get_timeline_name() in the majority of other DRM drivers in the first place. Those that do have a similar BUG_ON() (i915, xe) probably also need an update similar to this patch here but I'm not in a position to test those. Note that the adjacent drm_crtc_fence_get_timeline_name() has the same problem and is fixed by this patch as well. Fixes: 541c8f2468b9 ("dma-buf: detach fence ops on signal v3") Signed-off-by: André Draszik --- drivers/gpu/drm/drm_crtc.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index 63ead8ba6756..31c8636e7467 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -73,6 +73,9 @@ * &drm_mode_config_funcs.atomic_check. */ +#define fence_to_crtc(f) container_of((f)->extern_lock, \ + struct drm_crtc, fence_lock) + /** * drm_crtc_from_index - find the registered CRTC at an index * @dev: DRM device @@ -154,14 +157,6 @@ static void drm_crtc_crc_fini(struct drm_crtc *crtc) #endif } -static const struct dma_fence_ops drm_crtc_fence_ops; - -static struct drm_crtc *fence_to_crtc(struct dma_fence *fence) -{ - BUG_ON(rcu_access_pointer(fence->ops) != &drm_crtc_fence_ops); - return container_of(fence->extern_lock, struct drm_crtc, fence_lock); -} - static const char *drm_crtc_fence_get_driver_name(struct dma_fence *fence) { struct drm_crtc *crtc = fence_to_crtc(fence); --- base-commit: e2cae00c05d196491c318196792297f2dfbaa02c change-id: 20260618-linux-drm_crtc_fix2-23a7c354a412 Best regards, -- André Draszik