[PATCH] drm/vmwgfx: unpin BOs without revalidating placement

[PATCH] drm/vmwgfx: unpin BOs without revalidating placement

[潘煜杭]

Unpinning a buffer object does not change its memory placement.
Placement revalidation is unnecessary. Currently
vmw_bo_pin_reserved() calls ttm_bo_validate() for both pin and unpin
operations and treats any validation error as impossible with BUG_ON().

During PRIME/GEM cleanup, vmw_gem_object_unpin() calls
vmw_bo_pin_reserved(vbo, false). The Linux 7.3-based QEMU reproducer
confirmed that ttm_bo_validate() returned -EINVAL. The following BUG_ON()
crashed the kernel during process exit. 

The relevant report excerpt is:

  [   72.916147] [BO_PIN_TRACE] before-validate pin=0 old_mem_type=0 target_mem_type=0 flags=0x10
  [   72.916201] [BO_PIN_TRACE] after-validate ret=-22 old_mem_type=0 new_mem_type=0 ...
  [   72.918841] kernel BUG at drivers/gpu/drm/vmwgfx/vmwgfx_bo.c:342!
  [   72.918892] Oops: invalid opcode: 0000 [#1] SMP NOPTI
  [   72.933292] CPU: 1 UID: 0 PID: 346 Comm: repro_vmwgfx_bo
               Not tainted 7.3.0-dirty #2 PREEMPT(lazy)
  [   72.937912] RIP: 0010:vmw_bo_pin_reserved+0x36d/0x380
  [   72.947235] RBP: 00000000ffffffea
  [   72.990254] Fixing recursive fault but reboot is needed!

The reproducer created a dumb GEM buffer, exported/imported its PRIME fd,
performed GEM flink/open/close operations, and exited. During exit_group(),
the call path was vmw_gem_object_unpin() -> drm_gem_map_detach() ->
dma_buf_detach() -> drm_prime_gem_destroy() -> drm_gem_shmem_release() ->
vmw_bo_pin_reserved().

The fix skips ttm_bo_validate() when unpinning. Validation remains on the
pin path before ttm_bo_pin().

Assisted-by: OpenAI Codex (GPT-5)
Signed-off-by: Yuhang Pan <242270054@hdu.edu.cn>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
index 9c7a73c..14d28e2 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
@@ -308,6 +308,11 @@ void vmw_bo_pin_reserved(struct vmw_bo *vbo, bool pin)
     if (pin == !!bo->pin_count)
         return;
 
+    if (!pin) {
+        ttm_bo_unpin(bo);
+        return;
+    }
+
     pl.fpfn = 0;
     pl.lpfn = 0;
     pl.mem_type = bo->resource->mem_type;
@@ -321,8 +326,5 @@ void vmw_bo_pin_reserved(struct vmw_bo *vbo, bool pin)
 
     BUG_ON(ret != 0 || bo->resource->mem_type != old_mem_type);
 
-    if (pin)
-        ttm_bo_pin(bo);
-    else
-        ttm_bo_unpin(bo);
+    ttm_bo_pin(bo);
 }

-- 
2.34.1

Regards,
Yuhang Pan
242270054@hdu.edu.cn

Re: [PATCH] drm/vmwgfx: unpin BOs without revalidating placement

[Greg KH]

On Thu, Oct 29, 2026 at 04:19:24PM +0800, 潘煜杭 wrote:
> 
> Unpinning a buffer object does not change its memory placement.
> Placement revalidation is unnecessary. Currently
> vmw_bo_pin_reserved() calls ttm_bo_validate() for both pin and unpin
> operations and treats any validation error as impossible with BUG_ON().
> 
> During PRIME/GEM cleanup, vmw_gem_object_unpin() calls
> vmw_bo_pin_reserved(vbo, false). The Linux 7.3-based QEMU reproducer
> confirmed that ttm_bo_validate() returned -EINVAL. The following BUG_ON()
> crashed the kernel during process exit. 
> 
> The relevant report excerpt is:
> 
>   [   72.916147] [BO_PIN_TRACE] before-validate pin=0 old_mem_type=0 target_mem_type=0 flags=0x10
>   [   72.916201] [BO_PIN_TRACE] after-validate ret=-22 old_mem_type=0 new_mem_type=0 ...
>   [   72.918841] kernel BUG at drivers/gpu/drm/vmwgfx/vmwgfx_bo.c:342!
>   [   72.918892] Oops: invalid opcode: 0000 [#1] SMP NOPTI
>   [   72.933292] CPU: 1 UID: 0 PID: 346 Comm: repro_vmwgfx_bo
>                Not tainted 7.3.0-dirty #2 PREEMPT(lazy)
>   [   72.937912] RIP: 0010:vmw_bo_pin_reserved+0x36d/0x380
>   [   72.947235] RBP: 00000000ffffffea
>   [   72.990254] Fixing recursive fault but reboot is needed!
> 
> The reproducer created a dumb GEM buffer, exported/imported its PRIME fd,
> performed GEM flink/open/close operations, and exited. During exit_group(),
> the call path was vmw_gem_object_unpin() -> drm_gem_map_detach() ->
> dma_buf_detach() -> drm_prime_gem_destroy() -> drm_gem_shmem_release() ->
> vmw_bo_pin_reserved().
> 
> The fix skips ttm_bo_validate() when unpinning. Validation remains on the
> pin path before ttm_bo_pin().
> 
> Assisted-by: OpenAI Codex (GPT-5)
> Signed-off-by: Yuhang Pan <242270054@hdu.edu.cn>
> ---
>  drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
> index 9c7a73c..14d28e2 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
> @@ -308,6 +308,11 @@ void vmw_bo_pin_reserved(struct vmw_bo *vbo, bool pin)
>      if (pin == !!bo->pin_count)
>          return;
>  
> +    if (!pin) {
> +        ttm_bo_unpin(bo);
> +        return;
> +    }
> +
>      pl.fpfn = 0;
>      pl.lpfn = 0;
>      pl.mem_type = bo->resource->mem_type;
> @@ -321,8 +326,5 @@ void vmw_bo_pin_reserved(struct vmw_bo *vbo, bool pin)
>  
>      BUG_ON(ret != 0 || bo->resource->mem_type != old_mem_type);
>  
> -    if (pin)
> -        ttm_bo_pin(bo);
> -    else
> -        ttm_bo_unpin(bo);
> +    ttm_bo_pin(bo);
>  }
> 
> -- 
> 2.34.1

This patch is corrupted and can not be applied :(

Also, no Fixes: or cc: stable tags?

thanks,

greg k-h

Re: [PATCH] drm/vmwgfx: unpin BOs without revalidating placement

[Willy Tarreau]

On Thu, Oct 29, 2026 at 04:19:24PM +0800, you wrote:
> 
> Unpinning a buffer object does not change its memory placement.
> Placement revalidation is unnecessary. Currently
> vmw_bo_pin_reserved() calls ttm_bo_validate() for both pin and unpin
> operations and treats any validation error as impossible with BUG_ON().
(...)

Please *stop* CCing security@k.o for public e-mails. We already have
enough noise to stay busy, no need to add public messages there!

Thanks,
Willy