From nobody Fri Apr 3 16:14:02 2026 Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82D7C3F87FE; Tue, 24 Mar 2026 13:07:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.84.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774357676; cv=none; b=ikL3FvCbx9/u820CApNroKI4gKEf6EAO3IYZ46OTnABbyaioHjSDEFZ5xIdDugEABujkgl0bLVy7Y0ImD/X2pUxcVhhi5qfJqu2mROrkKLQg2X/ifqmEexXSBymzt+/CeiLpKjJEf9tiXaFmxOd4YbKHhvN2Ys3OpCU+6EcN4GM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774357676; c=relaxed/simple; bh=3gcDvKDiofu5+UBNldcs7iRDdzjLiu7N536dnvCCZcA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=tKs7ytyoAQ+yUhqVmz/qiNTxGUEDD2Iac7V2BMZuBH+sCEQwQh+j0opvzanKC89JnHUE3+UnNm4kcU/6R2hti85QYDel3SRIDbWNmwfddddwES3dDzc8ap1stC+5z5z8xd4QsstzVHikIc/1eO6G/upY9gAmzFGtsZGDym5eM34= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=QcbodRRZ; arc=none smtp.client-ip=185.246.84.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="QcbodRRZ" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id 1EBBE1A2FC6; Tue, 24 Mar 2026 13:07:53 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id E5B506011D; Tue, 24 Mar 2026 13:07:52 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id CC98510451277; Tue, 24 Mar 2026 14:07:44 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1774357670; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=fzs1pWNycSsS39sE+twHeUSR+qT4+7glSHwX8hsiv/I=; b=QcbodRRZQ7IqeUKtkAQoCsXRCzX49zCQ7c/T+hCSVAXapnmgLoW9sIiyhNT46+mtFpU61J gJKeSKsjZKwJOSysmrVxJF3olbTeDJZ2DqVTCNwCP9TRBajYIcDIENx5tLs+7THxp2dWu0 G/nuEQt7uiBb0r0BIkhRCZVn6pXSbqYfjcLzD/L4CbpSNR9WLcFeTQpZ4rS6QK/GzA8nkX h9C6LEGO1+qyCWSTqAgOYNv4hY+3xqTMYTAflOF0bmF5eF20QckGAirTPjA+Op1MqF0Nv7 40zg4pJn5YPXFwI/uVYiiJu5XpAy2TfiMXAYQmP7sGyJ6NVFPthK0xMFXjZ6wA== From: Luca Ceresoli Date: Tue, 24 Mar 2026 14:07:30 +0100 Subject: [PATCH v3] drm/atomic: drm_atomic_private_obj_fini: protect private_obj removal from list Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260324-drm-bridge-atomic-vs-remove-private_obj-v3-1-64deefe84044@bootlin.com> References: <20260324-drm-bridge-atomic-vs-remove-private_obj-v3-0-64deefe84044@bootlin.com> In-Reply-To: <20260324-drm-bridge-atomic-vs-remove-private_obj-v3-0-64deefe84044@bootlin.com> To: Harry Wentland , Leo Li , Rodrigo Siqueira , Alex Deucher , =?utf-8?q?Christian_K=C3=B6nig?= , David Airlie , Simona Vetter , Liviu Dudau , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Paul Cercueil , Rob Clark , Dmitry Baryshkov , Abhinav Kumar , Sean Paul , Marijn Suijten , Tomi Valkeinen , Thierry Reding , Mikko Perttunen , Jonathan Hunter , Dave Stevenson , =?utf-8?q?Ma=C3=ADra_Canal?= , Raspberry Pi Kernel Maintenance Cc: Hui Pu , Thomas Petazzoni , amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, linux-mips@vger.kernel.org, linux-arm-msm@vger.kernel.org, freedreno@lists.freedesktop.org, linux-tegra@vger.kernel.org, Ian Ray , Luca Ceresoli X-Mailer: b4 0.15.0 X-Last-TLS-Session-Version: TLSv1.3 Currently drm_bridge_detach() expects that the bridge private_obj is not locked by a drm_modeset_acquire_ctx, and it warns in case that happens: drm_bridge_detach() -> drm_atomic_private_obj_fini() -> list_del(&obj->head) // removes priv_obj from // dev->mode_config.privobj_list -> obj->funcs->atomic_destroy_state() -> drm_modeset_lock_fini(&obj->lock) -> WARN_ON(!list_empty(&lock->head)) // warn if priv_obj->lock // is still in ctx->locked The expectation is not respected when introducing bridge hot-plugging. In such case the warning triggers if the bridge is being removed concurrently to an operation that locks the private object using a drm_modeset_acquire_ctx, such as in this execution scenario: CPU0: drm_mode_obj_get_properties_ioctl() // userspace request -> DRM_MODESET_LOCK_ALL_BEGIN() . -> drm_for_each_privobj() // loop on dev->mode_config.privobj_list . - lock the privobj mutex . - add priv_obj->lock to ctx->locked . (list of locks to be released later) . . CPU1: . drm_bridge_detach() // bridge hot-unplug . -> WARN triggers! . -> DRM_MODESET_LOCK_ALL_END() -> for each lock in ctx->locked - remove priv_obj->lock from ctx->locked - unlock the privobj mutex Prevent this potential deadlock by using DRM_MODESET_LOCK_ALL_BEGIN/END() around the list removal in drm_atomic_private_obj_fini(). This ensures that exactly one of these happens: * the concurrent code (e.g. drm_mode_obj_get_properties_ioctl()) acquires all the locks first, so it can execute fully and release the privobj->lock before drm_atomic_private_obj_fini() calls list_del() and before the WARN_ON() * drm_atomic_private_obj_fini() acquires all the locks first, so it removes its privobj->lock from the dev->mode_config.privobj_list; the concurrent code will run afterwards and not acquire that lock because it is not present anymore Signed-off-by: Luca Ceresoli --- Changes in v3: - Rebased on current drm-misc-next (on 7.0-rc3) - Small commit message clarification Changes in v2: - added 'drm/atomic:' prefix to commit title - Adapted to work on top of "drm/atomic: Add dev pointer to drm_private_obj" - Slightly improved commit message --- drivers/gpu/drm/drm_atomic.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index 41c57063f3b4..0f9c2528c9ee 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -962,7 +962,13 @@ EXPORT_SYMBOL(drm_atomic_private_obj_init); void drm_atomic_private_obj_fini(struct drm_private_obj *obj) { + struct drm_modeset_acquire_ctx ctx; + int ret =3D 0; + + DRM_MODESET_LOCK_ALL_BEGIN(obj->dev, ctx, 0, ret); list_del(&obj->head); + DRM_MODESET_LOCK_ALL_END(obj->dev, ctx, ret); + obj->funcs->atomic_destroy_state(obj, obj->state); drm_modeset_lock_fini(&obj->lock); } --=20 2.53.0