From nobody Fri Dec 19 17:18:05 2025 Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 422FB2701DC for ; Mon, 13 Oct 2025 16:25:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.84.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760372715; cv=none; b=LPND5lJIinpJD5MFzKnyatRshB/fHGJMzNKAcfLZWdRe8cdaqiXb1uwPgBNapgoEuxPciLS1RRt9xxdAta2HoiYzvKLgQL5+a7zPlSbSItVXEWpCN5E8dtLiDVcOY8JLKrFSSzuhdXz9EHavoiXkUOdpzt7Z2w+gJdPOOx2rfFA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760372715; c=relaxed/simple; bh=Cy1uXxZB1SYXQYaLvBKqrPBCBk/c+HAQzdXcSoZ1C9w=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=WFo0htl32IwU5Y0NuQBG7xQCMIIyfY7KCmjesQH3U/3/5gbZqoc32JurjP6+Ri+I56cLzCAH4X6yCzTl43EDQoVeJ+eRkPG196RoZ0fi+UPkBsxZxxukO813eQ1U46ytuZrwmB0Wd/PfUhcIdO0jdTFNyuAVynCR/PsztSp0+uk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=oCUOSAm8; arc=none smtp.client-ip=185.246.84.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="oCUOSAm8" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id 8F76A1A1342; Mon, 13 Oct 2025 16:25:11 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 60DDA6067B; Mon, 13 Oct 2025 16:25:11 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 432C3102F2240; Mon, 13 Oct 2025 18:25:04 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1760372709; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=EYvKa1NV3blrMZOG3M4T8TIRo5Q0mosa2RgW0yGH+VY=; b=oCUOSAm8u75+NIooX1Iu/utEPRwF6wSEVsxC2e0orTivV67rSE/EUC+5tgmpm5Ge1G87TX OPWXNK1AU42EfctE/Wk1KxoK2VZ5mZUuLxAH8cIQaowSmFwQIF1j6F11IVvOiA7KhisMhn 0c/nR9aeBNArW6i3huyJKvjcxqIZ+rtkn6E4T9bvDIeLEiJXORxK2C/cZ6ylWJLf9EVeCG QbYrjbMehUQRdkjqBRv0drmS2sTBxpgU5N1xcQ5BKN28OB4v3Htu71Uxwp3ZoMUkLJkTEC EtUGmOWANdY7UgjMA4fLDhuQ3Be5whmv8MeZU8dyEbiAoG3E+DKsNuNhfeBvxg== From: Luca Ceresoli Date: Mon, 13 Oct 2025 18:24:23 +0200 Subject: [PATCH 2/2] drm_atomic_private_obj_fini: protect private_obj removal from list Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251013-drm-bridge-atomic-vs-remove-private_obj-v1-2-1fc2e58102e0@bootlin.com> References: <20251013-drm-bridge-atomic-vs-remove-private_obj-v1-0-1fc2e58102e0@bootlin.com> In-Reply-To: <20251013-drm-bridge-atomic-vs-remove-private_obj-v1-0-1fc2e58102e0@bootlin.com> To: Harry Wentland , Leo Li , Rodrigo Siqueira , Alex Deucher , =?utf-8?q?Christian_K=C3=B6nig?= , David Airlie , Simona Vetter , Liviu Dudau , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Paul Cercueil , Rob Clark , Dmitry Baryshkov , Abhinav Kumar , Jessica Zhang , Sean Paul , Marijn Suijten , Tomi Valkeinen , Thierry Reding , Mikko Perttunen , Jonathan Hunter , Dave Stevenson , =?utf-8?q?Ma=C3=ADra_Canal?= , Raspberry Pi Kernel Maintenance Cc: Hui Pu , Thomas Petazzoni , amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, linux-mips@vger.kernel.org, linux-arm-msm@vger.kernel.org, freedreno@lists.freedesktop.org, linux-tegra@vger.kernel.org, Luca Ceresoli X-Mailer: b4 0.14.2 X-Last-TLS-Session-Version: TLSv1.3 Currently drm_bridge_detach() expects that the bridge private_obj is not locked by a drm_modeset_acquire_ctx, and it warns in case that happens: drm_bridge_detach() -> drm_atomic_private_obj_fini() -> list_del(&obj->head) // removes priv_obj from // dev->mode_config.privobj_list -> obj->funcs->atomic_destroy_state() -> drm_modeset_lock_fini(&obj->lock) -> WARN_ON(!list_empty(&lock->head)) // warn if priv_obj->lock // is still in ctx->locked The expectation is not respected when adding bridge hot-plugging. In such case the warning triggers if the bridge is being removed concurrently to an operation that locks the private object using a drm_modeset_acquire_ctx, such as in this execution scenario: CPU0: drm_mode_obj_get_properties_ioctl() // userspace request -> DRM_MODESET_LOCK_ALL_BEGIN() . -> drm_for_each_privobj() // loop on dev->mode_config.privobj_list . - lock the privobj mutex . - add priv_obj->lock to ctx->locked . (list of locks to be released) . . CPU1: . drm_bridge_detach() // bridge hot-unplug . -> WARN triggers! . -> DRM_MODESET_LOCK_ALL_END() -> for each lock in ctx->locked - remove priv_obj->lock from ctx->locked - unlock the privobj mutex Fix this by using DRM_MODESET_LOCK_ALL_BEGIN/END() around the list removal in drm_atomic_private_obj_fini(). This ensures that exactly one of these happens: * the concurrent code (e.g. drm_mode_obj_get_properties_ioctl()) acquires all the locks first, so it can execute fully and release the privobj->lock before drm_atomic_private_obj_fini() calls list_del() and before the WARN_ON() * drm_atomic_private_obj_fini() acquires all the locks first, so it removes its privobj->lock from the dev->mode_config.privobj_list; the concurrent code will run afterwards and not acquire that lock because it is not present anymore Signed-off-by: Luca Ceresoli --- drivers/gpu/drm/drm_atomic.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index 7910dacb269c03a0f3e1785bb864d228a693a1aa..aa13389a8efe06b0f67cdce4699= d403906b282be 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -810,7 +810,13 @@ void drm_atomic_private_obj_fini(struct drm_device *dev, struct drm_private_obj *obj) { + struct drm_modeset_acquire_ctx ctx; + int ret =3D 0; + + DRM_MODESET_LOCK_ALL_BEGIN(dev, ctx, 0, ret); list_del(&obj->head); + DRM_MODESET_LOCK_ALL_END(dev, ctx, ret); + obj->funcs->atomic_destroy_state(obj, obj->state); drm_modeset_lock_fini(&obj->lock); } --=20 2.51.0