From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oa1-f99.google.com (mail-oa1-f99.google.com [209.85.160.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8D4DF3D566D for ; Wed, 15 Jul 2026 23:34:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.99 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784158484; cv=none; b=FaaadG/BPm+Dla+axGas/m8NlNaYWomqWS4I8fvMknj5L6ymOAo2q9mv+ahc3GvnprXeJwZDT3j6o6+9YaqsrRVTBdDunpvxJoTHSw5FWMQ6WA7KpdbTSvQCNzxmUDf8g7oLxkqwyEofYo6RRgyyeUz3o4l722gYfQYi9yI/Wf0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784158484; c=relaxed/simple; bh=5uBH49bF0l8b+rZr56Du2J22HfwNH0JL70frA6uBY1s=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=L/pESNKtY1JQjA0VBR0sWbuypJl8Nw0ZAVm6S4cP8kcwJajiEnv0VGAT96tLy7WcAHIHcBbaSefwE5gF06RkV8onTs/w0wP0T+5kI2DAmilhaues9eMLjAexMo8XkE8GyHXXur17McZpAgBDCbXkLQhQwm2x0HYB9fZ5QD5Lksg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com; spf=fail smtp.mailfrom=broadcom.com; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b=h1Z0DR0O; arc=none smtp.client-ip=209.85.160.99 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=broadcom.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b="h1Z0DR0O" Received: by mail-oa1-f99.google.com with SMTP id 586e51a60fabf-4471b489240so1961942fac.2 for ; Wed, 15 Jul 2026 16:34:41 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784158480; x=1784763280; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:dkim-signature:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=GXieirGK731dKnqo4Q/8RQmfvuOGtB9/de8gOedyZqE=; b=hIbW1d+CosYUkpciWEYMEWUqz/Nu06s0dvvJl/MZdrvthhpCzszlv4vYHDSV2pRUAk XBPMWgOHY0PmvWdmkySQcWSEAh7NY/X5KqbUSdhuabxsD/HomX3UQjmMlrDO2MWdu8mg nPkteA0E71RHiZvjganBxezmy3KbpBHSZJzpjJVKLqO4SP1t1qVl45knNLPaM4YDX6NK pkFiGPk6NPoqY4HCweTKZtgy9qkEDa5LimACXoHaWyI3FUQHlFmU3q7kxyv1tmZKX8id t9V4n6Oqevmzv8sx2RW1g6K3aPdsMipdO0NGlqiRgcy/Zc+T5BBJEroOJEAaATUAbq6l CfGQ== X-Forwarded-Encrypted: i=1; AHgh+Ron7fSiDXA9nV/GqKXAg18JKVB0NvM/iZl3Jljq67lWICG3udKZKtY4DMYAec5XnQW53eTliYyJaOU+fho=@vger.kernel.org X-Gm-Message-State: AOJu0YyEUTnfB6n2yMm+DJ5xyKUnzvxz1ZRZKVmdaxIrYNWB396ETlUu UC1SR8OkdltGR4fqY52jHSx5Ekc/xvCXpU0LcnBSsmNAd0EW+fcglxKSMQtS1cgSEpshxTY/mSw 8nT8dkre9H0U3F8Tf7PSnWzVBf874l/lobNKN89neR2TY3/cy+CCtlqufX+Pd1Wc2kd5x72RBrR YJ5X/A/s/sJec1Xq+5W3TF3TeFyRMekl7liTQBHjFt88it8zPmI/zX9fsvQ+f3gsiK7wUJWE6ef ssdWgvdllg4fK5jkrPh2QoV X-Gm-Gg: AfdE7ckEnKLpgOAJ4zRoXs+jvviUDexcyF1NpMKBgcNaqDzEi2M5+MMK5j+D5Zvc0n+ xry1mJBcGdigJz7AcIlAIMSSaflYD38pHttYkd/9aJBdzqSRIJrwuOR4vhcosHLfn7gRndi3wA0 VBydACKKHR3sL6eWLEo5fSTe9LJtHlsU+mxcCTRblK7HefyOoNcNJENk5SCROP2xtG/FocTrwnD 5mxXyI9/8r52/yZdTRfCMvZcm3sd5Jiqtk2SEsD7QuN/f/jX/uRM9XbLhWjpBdk/Qxy5DJbykJ0 IzPp74dSKCvlYotWMXlY8Obld7hUsx6Q5/kNNLtfCe9MlfJfgL65mcA8PG5VPmpGbFyqSirvuia rdRxSxyom7nSLe57WKRCme5EOiDfCm60uNoSGVTM56KzUgH+AjBKWJls68nQdlc7KDvc9fQvVaK GXfgmSuznLmH2CyAu8G/B9jcuJOoxzwJ/mif3S7g== X-Received: by 2002:a05:6870:7008:b0:43d:1689:ed9c with SMTP id 586e51a60fabf-4562b67763emr3063186fac.18.1784158480354; Wed, 15 Jul 2026 16:34:40 -0700 (PDT) Received: from smtp-us-east1-p01-i01-si01.dlp.protect.broadcom.com (address-144-49-247-0.dlp.protect.broadcom.com. [144.49.247.0]) by smtp-relay.gmail.com with ESMTPS id 586e51a60fabf-45191728f10sm2115434fac.9.2026.07.15.16.34.40 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 15 Jul 2026 16:34:40 -0700 (PDT) X-Relaying-Domain: broadcom.com X-CFilter-Loop: Reflected Received: by mail-qv1-f70.google.com with SMTP id 6a1803df08f44-8eec6acbe21so139823446d6.3 for ; Wed, 15 Jul 2026 16:34:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; t=1784158479; x=1784763279; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to:content-type; bh=GXieirGK731dKnqo4Q/8RQmfvuOGtB9/de8gOedyZqE=; b=h1Z0DR0OQlKRxN3552qD2hkYLY6b6TFqt6gxyfyJwYxnwdDkSGlwF5hIzgXRnG6pZY Bdp43atrdpYMjV//f3XPt4Un6Q5MRCxNTMwC0pWnOQvl0MYmO0ast6hFWwOKWgwdOm8k zNNC4bxuSfQXv2rtzcbbNC0iLEvhDFJFi+68U= X-Forwarded-Encrypted: i=1; AHgh+Rrr4oelhdB02C9er/MegYjgWU3yui+FFqTo07GXYjD2DAgn1kj/JghhjTM+xikyp21b+YbVx7NN1adldM0=@vger.kernel.org X-Received: by 2002:ac8:5d50:0:b0:51c:bc76:dae0 with SMTP id d75a77b69052e-51e4f0bb49dmr50595731cf.57.1784158479447; Wed, 15 Jul 2026 16:34:39 -0700 (PDT) X-Received: by 2002:ac8:5d50:0:b0:51c:bc76:dae0 with SMTP id d75a77b69052e-51e4f0bb49dmr50595521cf.57.1784158478967; Wed, 15 Jul 2026 16:34:38 -0700 (PDT) Received: from [10.211.247.235] ([192.19.50.250]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-904116650b7sm183978416d6.8.2026.07.15.16.34.37 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 15 Jul 2026 16:34:38 -0700 (PDT) Message-ID: <2df4713f-bf61-40de-a43f-5079e3b5d5fa@broadcom.com> Date: Wed, 15 Jul 2026 16:39:22 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] drm/vmwgfx: uninstall the IRQ before freeing the command buffer manager on unload To: Fan Wu , Zack Rusin Cc: bcm-kernel-feedback-list@broadcom.com, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org References: <20260714094511.2960308-1-fanwu01@zju.edu.cn> From: Maaz Mombasawala Content-Language: en-US In-Reply-To: <20260714094511.2960308-1-fanwu01@zju.edu.cn> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-DetectorID-Processed: b00c1d49-9d2e-4205-b15f-d015386d3d5e On 7/14/26 2:45 AM, Fan Wu wrote: > vmw_driver_unload() frees the command buffer manager before uninstalling > the device IRQ. vmw_release_device_late() -> vmw_cmdbuf_man_destroy() > frees the manager, while the threaded handler vmw_thread_fn(), released > only later by vmw_irq_uninstall() -> free_irq(), dereferences > dev_priv->cman without a NULL guard and is the sole producer of > schedule_work(&man->work), whose worker vmw_cmdbuf_work_func() recovers > the manager via container_of(). dev_priv->cman is never NULLed on the > unload path, so a handler woken in the window between kfree(man) and > free_irq() runs against freed memory and can re-arm man->work after the > manager's cancel_work_sync() has already returned. > > Reorder the unload path to drain pending fences, then uninstall the IRQ, > and only then free the manager: free_irq() guarantees the threaded > handler has exited before kfree(man). vmw_fence_fifo_down() is called > explicitly before the IRQ uninstall so its dma_fence waits are signalled > by the still-live threaded handler (vmw_fences_update() in > vmw_thread_fn()); uninstalling the IRQ first could force pending fence > waits to time out at VMW_FENCE_WAIT_TIMEOUT. vmw_release_device_late() > is left unchanged because it is shared with the hibernation path; its > existing call to vmw_fence_fifo_down() runs against an empty fence list > after the explicit drain above. > > Fixes: ef369904aaf7 ("drm/vmwgfx: Move irq bottom half processing to threads") > Cc: stable@vger.kernel.org > Assisted-by: Codex:gpt-5.5 > Signed-off-by: Fan Wu > --- > drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c > index 599052d07ae88af2f5775f968fe1e7046a3efe4e..dbe02fe8d8571587733d6f002436bf18dac1887a 100644 > --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c > +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c > @@ -1181,10 +1181,11 @@ > vmw_devcaps_destroy(dev_priv); > vmw_vram_manager_fini(dev_priv); > ttm_device_fini(&dev_priv->bdev); > - vmw_release_device_late(dev_priv); > - vmw_fence_manager_takedown(dev_priv->fman); > + vmw_fence_fifo_down(dev_priv->fman); > if (dev_priv->capabilities & SVGA_CAP_IRQMASK) > vmw_irq_uninstall(&dev_priv->drm); > + vmw_release_device_late(dev_priv); > + vmw_fence_manager_takedown(dev_priv->fman); > > ttm_object_device_release(&dev_priv->tdev); > > -- > 2.39.5 > With this patch we would miss any command buffer processing done on the svga device in the window between irq_uninstall and vmw_cmdbuf_man_destroy(), so it's better to leave the takedown order as is. If you want to address the case where a thread_fn awoken by an earlier irq is scheduled before irq_uinstall but after vmw_cmdbuf_man_destroy(), then just add checks to vmw_thread_fn(), though I'm not sure if that case is even possible since the command buffer contexts should already be taken down at that point. -- Maaz Mombasawala