From nobody Sat Jun 13 17:02:39 2026 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F1DA33E3DB9; Wed, 6 May 2026 12:16:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778069801; cv=none; b=OHMDchg01uHXh3QErFkodLiMDcQPqw2s8A1boB3e3ifsapAvGuaEtG9JtzUW/WyHFuEMytuerTX0eGMvKaNcvR3pPIvA3yeaSSPKKbK6SSiGq16sWEXfbdSpdkqoZCpDZYZ7zSsTtStMnx2nnr0KW9CKSIzKfkJ2d23RUlZkLFs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778069801; c=relaxed/simple; bh=bhfUdxskTM5eHiDMoxut02UxySr7YulKIsinhbB2loU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=TgKtt60W1zMkzTc6xzqPqMn9IGwlPNw0LMGniAjWvCVw5bCIAGry98OKsvjvj7Uj/EHbKRAWWbW9OfPZO7w8jSf61ryRDJaPju3iH8ZDtjuokH7ELkGkpdJW43OVKZUcKQ06kgs40VIp+w1cPFX1NG7hYKcD2XYlenPQSt5cIVM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=JRYNrhtX; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="JRYNrhtX" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1778069798; bh=bhfUdxskTM5eHiDMoxut02UxySr7YulKIsinhbB2loU=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=JRYNrhtXdh4SwlO/Xo8DsGy0cQBsJ7IeNhNbRySUIf+QTa5++UQyExPC4jBNuzav1 CUeZs6ENbRXUngd+Qj/7vFPjMGXIAXs13LwwHDWw4tlSMPZayWttzixd1h8CkN095e C+80RLVsMcZDhLL8acx+G5iBLDf9lMF29yv8DV4Z1NR9SUKdRzcwBYOXSDPUXLzLJi hGYz6L+Bg1bCKN9gUzrAxyPZJ+NH6XscC23rja2tmosTxxJXXKaMwl5xbRAYS08a94 66ZPSbwg5uXNGVFE/0KnJn0mEyH9m99h76/XIdH2C8d6buDJms1uaSq2F5VUPhwnZW KWvxTI8S3Halw== Received: from [100.64.0.11] (unknown [100.64.0.11]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: bbrezillon) by bali.collaboradmins.com (Postfix) with ESMTPSA id 9813C17E1525; Wed, 6 May 2026 14:16:37 +0200 (CEST) From: Boris Brezillon Date: Wed, 06 May 2026 14:16:26 +0200 Subject: [PATCH 1/3] drm/panthor: Don't use the racy drm_gem_lru_remove() helper Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260506-panthor-shrinker-fixes-v1-1-e7721526de96@collabora.com> References: <20260506-panthor-shrinker-fixes-v1-0-e7721526de96@collabora.com> In-Reply-To: <20260506-panthor-shrinker-fixes-v1-0-e7721526de96@collabora.com> To: Steven Price , Liviu Dudau , Boris Brezillon , Dmitry Osipenko Cc: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Akash Goel , Chia-I Wu , Rob Clark , Dmitry Baryshkov , Abhinav Kumar , Jessica Zhang , Sean Paul , Marijn Suijten , linux-arm-msm@vger.kernel.org, freedreno@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778069796; l=3557; i=boris.brezillon@collabora.com; s=20260429; h=from:subject:message-id; bh=bhfUdxskTM5eHiDMoxut02UxySr7YulKIsinhbB2loU=; b=O2/ZfA/x6LWTnFgb5+Ig3AX2o7bvW0n2h3REdsGABoRpd2SI/bK9XAjjbLg4lttbiP15FDzpD pRq2QwZDfTHCPTIVIbSWruFOpf5ncbHlZimE/LRtWgc6Gs4dTSN/wRI X-Developer-Key: i=boris.brezillon@collabora.com; a=ed25519; pk=eN+ORdOgQY7d5U+0kA8h5bf67XdD8bhKbjD/TCHexSY= drm_gem_lru_remove() dereference stores drm_gem_object::lru in a local variable that's then dereferenced to acquire the LRU lock. Because this assignment in done without the LRU lock held, it can race with drm_gem_lru_scan() where drm_gem_object::lru is temporarily assigned a stack-allcated LRU that goes away when leaving the function. By the time we dereference this local lru variable, the object might already be gone. It feels like drm_gem_lru_move_tail() was never meant to be used this way, because there's no easy way we can avoid this race unless we defer the locking to the caller. Let's add an explicit LRU for unreclaimable BOs instead, and have all BOs added to this LRU at creation time. Fixes: fb42964e2a76 ("drm/panthor: Add a GEM shrinker") Reported-by: Chia-I Wu Closes: https://gitlab.freedesktop.org/panfrost/linux/-/work_items/86 Signed-off-by: Boris Brezillon Reviewed-by: Chia-I Wu Reviewed-by: Liviu Dudau Reviewed-by: Steven Price --- drivers/gpu/drm/panthor/panthor_device.h | 10 ++++++++++ drivers/gpu/drm/panthor/panthor_gem.c | 5 ++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/panthor/panthor_device.h b/drivers/gpu/drm/pan= thor/panthor_device.h index 4e4607bca7cc..45b71546f83c 100644 --- a/drivers/gpu/drm/panthor/panthor_device.h +++ b/drivers/gpu/drm/panthor/panthor_device.h @@ -190,6 +190,16 @@ struct panthor_device { /** @reclaim.lock: Lock protecting all LRUs */ struct mutex lock; =20 + /** + * @reclaim.unreclaimable: unreclaimable BOs + * + * Either the BO is unreclaimable because it has no pages allocated, + * or it's unreclaimable because pages are pinned. + * + * All BOs start in that list at creation time. + */ + struct drm_gem_lru unreclaimable; + /** * @reclaim.unused: BOs with unused pages * diff --git a/drivers/gpu/drm/panthor/panthor_gem.c b/drivers/gpu/drm/pantho= r/panthor_gem.c index 13295d7a593d..8e31740126e7 100644 --- a/drivers/gpu/drm/panthor/panthor_gem.c +++ b/drivers/gpu/drm/panthor/panthor_gem.c @@ -204,7 +204,7 @@ void panthor_gem_update_reclaim_state_locked(struct pan= thor_gem_object *bo, drm_gem_lru_move_tail(&ptdev->reclaim.gpu_mapped_shared, &bo->base); break; case PANTHOR_GEM_UNRECLAIMABLE: - drm_gem_lru_remove(&bo->base); + drm_gem_lru_move_tail(&ptdev->reclaim.unreclaimable, &bo->base); break; default: drm_WARN(&ptdev->base, true, "invalid GEM reclaim state (%d)\n", new_sta= te); @@ -994,6 +994,7 @@ static struct panthor_gem_object * panthor_gem_create(struct drm_device *dev, size_t size, uint32_t flags, struct panthor_vm *exclusive_vm, u32 usage_flags) { + struct panthor_device *ptdev =3D container_of(dev, struct panthor_device,= base); struct panthor_gem_object *bo; int ret; =20 @@ -1026,6 +1027,7 @@ panthor_gem_create(struct drm_device *dev, size_t siz= e, uint32_t flags, } =20 panthor_gem_debugfs_set_usage_flags(bo, usage_flags); + drm_gem_lru_move_tail(&ptdev->reclaim.unreclaimable, &bo->base); return bo; =20 err_put: @@ -1551,6 +1553,7 @@ int panthor_gem_shrinker_init(struct panthor_device *= ptdev) return ret; =20 INIT_LIST_HEAD(&ptdev->reclaim.vms); + drm_gem_lru_init(&ptdev->reclaim.unreclaimable, &ptdev->reclaim.lock); drm_gem_lru_init(&ptdev->reclaim.unused, &ptdev->reclaim.lock); drm_gem_lru_init(&ptdev->reclaim.mmapped, &ptdev->reclaim.lock); drm_gem_lru_init(&ptdev->reclaim.gpu_mapped_shared, &ptdev->reclaim.lock); --=20 2.54.0 From nobody Sat Jun 13 17:02:39 2026 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 165C84418DB; Wed, 6 May 2026 12:16:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778069802; cv=none; b=iyrCIqZ9znOPk6BqavZt9Nx/Dg6LgGCF1G3ukvRK5TxDAvn/fyXWaTKAlVrd1PwvqdIo0/ItS2diFZLU8qRXT/tWg9GYBxMG6HI57P3tBoGDg4To9Cwce54TaQLe9jU4tO4CoRYeMYJHLoK52V9H+5ZizSyC11qkV24WSPQ1TTY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778069802; c=relaxed/simple; bh=u1rbbnIoyFZA7O2vs7QHol/yHibz7ircmGOOnRxEjGA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=bY+7txzvb0AfiaQhBb6/fwa7D7YJlU3NssdMoeD7qZ0R8GlRwNYIsKeXBlNqAK81qpjULr0ZcOeDuNP1NBzxaK3li2Arf4tKGOUcJGbggJncPgpaieVv0XKg2kny8gGUTmk1fgpU+sWTwJ0mWHT1AqIvI0yEn4pvEGmBB21+dtY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=HwIiRzUq; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="HwIiRzUq" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1778069799; bh=u1rbbnIoyFZA7O2vs7QHol/yHibz7ircmGOOnRxEjGA=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=HwIiRzUqisePGYSP+oQv8nut2BrQ2Y8Yz8rFZyvpXSXIu7PXyeQTv249ZYry8t5FR fFHvXPH6osctGucWoC4Py5gh+56RV9cb2cKqXg+xZxMlxkr1BU1nMaLmEF0dY/9bom 8U6gtSxzpKQD4MJedEhlwrdzVZ9xguxercMdIKl5K/scxHlpTCCqd7FaDDtQBgib3s vrDk7euO9rvVmNaF3F94HWrpkFy9aQLBdySDTuFadoQ9f5BoQkUx07lfZBLQNclaNM bKNNVU/J5Dug5BJUUW8lL+kKmty/lAwn86wPo/uyg5ZwUoFWMMniXkivncb7UWOAzh uQPcjpPDJ4r0w== Received: from [100.64.0.11] (unknown [100.64.0.11]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: bbrezillon) by bali.collaboradmins.com (Postfix) with ESMTPSA id 94F7917E1537; Wed, 6 May 2026 14:16:38 +0200 (CEST) From: Boris Brezillon Date: Wed, 06 May 2026 14:16:27 +0200 Subject: [PATCH 2/3] drm/gem: Fix a race between drm_gem_lru_scan() and drm_gem_object_release() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260506-panthor-shrinker-fixes-v1-2-e7721526de96@collabora.com> References: <20260506-panthor-shrinker-fixes-v1-0-e7721526de96@collabora.com> In-Reply-To: <20260506-panthor-shrinker-fixes-v1-0-e7721526de96@collabora.com> To: Steven Price , Liviu Dudau , Boris Brezillon , Dmitry Osipenko Cc: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Akash Goel , Chia-I Wu , Rob Clark , Dmitry Baryshkov , Abhinav Kumar , Jessica Zhang , Sean Paul , Marijn Suijten , linux-arm-msm@vger.kernel.org, freedreno@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778069796; l=2777; i=boris.brezillon@collabora.com; s=20260429; h=from:subject:message-id; bh=u1rbbnIoyFZA7O2vs7QHol/yHibz7ircmGOOnRxEjGA=; b=0Vn0g7A6fEq54VBM8lGGCLNX9mHH+iAkL1OkGKe/jCH9w71OWroJV8R46OeF5EN1tdfdBhZwI cmjDTvLf01KDnH2rNOTeUgKqGCKEDTXPmK0yMv53DqAjtz8gkdpAlyR X-Developer-Key: i=boris.brezillon@collabora.com; a=ed25519; pk=eN+ORdOgQY7d5U+0kA8h5bf67XdD8bhKbjD/TCHexSY= The following race can currently happen: | Thread 0 in `drm_gem_lru_scan` | Thread 1 in `drm_gem_objec= t_release` | | - | - = | | move obj1 with refcount=3D=3D0 to `still_in_lru` | = | | move obj2 with refcount!=3D0 to `still_in_lru` | = | | mutex_unlock | = | | shrink obj2 | = | | | lru =3D obj1->lru; // `sti= ll_in_lru` | | mutex_lock | = | | move obj1 back to the original lru | = | | mutex_unlock | = | | return | = | | | dereference `still_in_lru`= | Move the drm_gem_lru_move_tail_locked() after the kref_get_unless_zero() check so that we don't end up with a vanishing LRU when we hit drm_gem_object_release(). We also need to remove the skipped object from its LRU, otherwise we'll keep hitting it on subsequent loop iterations until it's actually removed from the list in the drm_gem_release(). Fixes: e7c2af13f811 ("drm/gem: Add LRU/shrinker helper") Reported-by: Chia-I Wu Closes: https://gitlab.freedesktop.org/panfrost/linux/-/work_items/86 Signed-off-by: Boris Brezillon Reviewed-by: Chia-I Wu Reviewed-by: Liviu Dudau --- drivers/gpu/drm/drm_gem.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index fca42949eb2b..97cf63de0112 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -1660,15 +1660,19 @@ drm_gem_lru_scan(struct drm_gem_lru *lru, if (!obj) break; =20 - drm_gem_lru_move_tail_locked(&still_in_lru, obj); - /* * If it's in the process of being freed, gem_object->free() - * may be blocked on lock waiting to remove it. So just - * skip it. + * may be blocked on lock waiting to remove it. So just remove + * it from its current LRU and skip it. */ - if (!kref_get_unless_zero(&obj->refcount)) + if (!kref_get_unless_zero(&obj->refcount)) { + if (obj->lru) + drm_gem_lru_remove_locked(obj); + continue; + } + + drm_gem_lru_move_tail_locked(&still_in_lru, obj); =20 /* * Now that we own a reference, we can drop the lock for the --=20 2.54.0 From nobody Sat Jun 13 17:02:39 2026 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E476D44B674; Wed, 6 May 2026 12:16:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778069803; cv=none; b=HP6cz7JYZ+1CZBEC49djTQbOlTQkIbPRcZXhaFds1Bk17F65ikOCRpnY6gWiQ7m3hHfiWJlzU4/pD0JjdDmw2ns/z0KHCILwTwPtuUDmgXl53I+0fWYL/MpNGZePKot9XfYWvYh2dR7FvH8+4g0tURfSdefuRgBGTJC6tW1a5Nw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778069803; c=relaxed/simple; bh=WOtqjv3FDzYb3+bj/irlhWg2OHoRy/G/0OVw3EpOZOY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=hSoQUE6vni1p4KsdxSs/7wOhcWYmpDx9lX8vwVURVQHXuTxdczfdrTwkQsOPzsUJT9uCi1XBlyOcVgqqd24mB0erImXMcvFDC0LYPjeeZbHkjB6t4dTQ3xNsLd9L87Ezqf6qYPCgJWcGwJ3T0bHga6IpAZSzSdHXmhy9XztwzkA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=LjHrHRS0; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="LjHrHRS0" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1778069800; bh=WOtqjv3FDzYb3+bj/irlhWg2OHoRy/G/0OVw3EpOZOY=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=LjHrHRS0urOjbm8y0X0K21zx9YomzGIGQgtQysgaUuExqQanzt93OBDCZQ5RGmo0D sQBxW+649Kwan1TI2gKcGAGd3OPR8oTpexAtRwIbUybuZ5jE4epfbdgayiApSclD/e 9sJIi694TdfsTiZN9EyGVuTODpSC0jGCkec5S3qzcbhdO/lrnMNTZXfujS/z5bakdv PEJ211H/bJZaAdHEI+8RGtTsSYEAVIlR0XDexrmnerYNyPQTv0A+3BeAau9xSMMPMN uVt30Zt1yWTrI5Tnaoubv6EDBAln6ZA0ISSU7+i3fAp9o2JjiNA9ku5rBtsIq4dG3i YAzx3KLt4/Ekg== Received: from [100.64.0.11] (unknown [100.64.0.11]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: bbrezillon) by bali.collaboradmins.com (Postfix) with ESMTPSA id 929CB17E1562; Wed, 6 May 2026 14:16:39 +0200 (CEST) From: Boris Brezillon Date: Wed, 06 May 2026 14:16:28 +0200 Subject: [PATCH 3/3] drm/gem: Stop exposing the racy/unsafe drm_gem_lru_remove() helper Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260506-panthor-shrinker-fixes-v1-3-e7721526de96@collabora.com> References: <20260506-panthor-shrinker-fixes-v1-0-e7721526de96@collabora.com> In-Reply-To: <20260506-panthor-shrinker-fixes-v1-0-e7721526de96@collabora.com> To: Steven Price , Liviu Dudau , Boris Brezillon , Dmitry Osipenko Cc: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Akash Goel , Chia-I Wu , Rob Clark , Dmitry Baryshkov , Abhinav Kumar , Jessica Zhang , Sean Paul , Marijn Suijten , linux-arm-msm@vger.kernel.org, freedreno@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778069796; l=3269; i=boris.brezillon@collabora.com; s=20260429; h=from:subject:message-id; bh=WOtqjv3FDzYb3+bj/irlhWg2OHoRy/G/0OVw3EpOZOY=; b=UeuoKbZtO0sViuF9+YSdaQdvfa4dctHnpv4/OJEcfdfHbK3bU5SITMtB3cxZlrM8SbP+/junN DztOTEFUK0jAPlEEFeD+7lb0troRRmqAofaEAwHgiOIYyo1HNJCXHOD X-Developer-Key: i=boris.brezillon@collabora.com; a=ed25519; pk=eN+ORdOgQY7d5U+0kA8h5bf67XdD8bhKbjD/TCHexSY= The only place where it's safe to call drm_gem_lru_remove() is when we know the drm_gem_object::lru field can't be concurrently updated, which we know is the case when the drm_gem_object is destroyed. Rather than trying to make that safe, let's kill the function and inline its content in drm_gem_object_release(). Signed-off-by: Boris Brezillon Reviewed-by: Chia-I Wu Reviewed-by: Liviu Dudau Reviewed-by: Steven Price --- drivers/gpu/drm/drm_gem.c | 49 +++++++++++++++++--------------------------= ---- include/drm/drm_gem.h | 1 - 2 files changed, 18 insertions(+), 32 deletions(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 97cf63de0112..b6df4f62f7b5 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -1108,6 +1108,15 @@ drm_gem_release(struct drm_device *dev, struct drm_f= ile *file_private) idr_destroy(&file_private->object_idr); } =20 +static void +drm_gem_lru_remove_locked(struct drm_gem_object *obj) +{ + obj->lru->count -=3D obj->size >> PAGE_SHIFT; + WARN_ON(obj->lru->count < 0); + list_del(&obj->lru_node); + obj->lru =3D NULL; +} + /** * drm_gem_object_release - release GEM buffer object resources * @obj: GEM buffer object @@ -1124,7 +1133,15 @@ drm_gem_object_release(struct drm_gem_object *obj) drm_gem_private_object_fini(obj); =20 drm_gem_free_mmap_offset(obj); - drm_gem_lru_remove(obj); + + /* If the object refcount drops to zero, it means no one can change + * the LRU it's inserted into, so it's safe to dereference + * drm_gem_object::lru without the drm_gem_lru::lock held. + */ + if (obj->lru) { + guard(mutex)(obj->lru->lock); + drm_gem_lru_remove_locked(obj); + } } EXPORT_SYMBOL(drm_gem_object_release); =20 @@ -1552,36 +1569,6 @@ drm_gem_lru_init(struct drm_gem_lru *lru, struct mut= ex *lock) } EXPORT_SYMBOL(drm_gem_lru_init); =20 -static void -drm_gem_lru_remove_locked(struct drm_gem_object *obj) -{ - obj->lru->count -=3D obj->size >> PAGE_SHIFT; - WARN_ON(obj->lru->count < 0); - list_del(&obj->lru_node); - obj->lru =3D NULL; -} - -/** - * drm_gem_lru_remove - remove object from whatever LRU it is in - * - * If the object is currently in any LRU, remove it. - * - * @obj: The GEM object to remove from current LRU - */ -void -drm_gem_lru_remove(struct drm_gem_object *obj) -{ - struct drm_gem_lru *lru =3D obj->lru; - - if (!lru) - return; - - mutex_lock(lru->lock); - drm_gem_lru_remove_locked(obj); - mutex_unlock(lru->lock); -} -EXPORT_SYMBOL(drm_gem_lru_remove); - /** * drm_gem_lru_move_tail_locked - move the object to the tail of the LRU * diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h index 86f5846154f7..d527df98d142 100644 --- a/include/drm/drm_gem.h +++ b/include/drm/drm_gem.h @@ -611,7 +611,6 @@ int drm_gem_dumb_map_offset(struct drm_file *file, stru= ct drm_device *dev, u32 handle, u64 *offset); =20 void drm_gem_lru_init(struct drm_gem_lru *lru, struct mutex *lock); -void drm_gem_lru_remove(struct drm_gem_object *obj); void drm_gem_lru_move_tail_locked(struct drm_gem_lru *lru, struct drm_gem_= object *obj); void drm_gem_lru_move_tail(struct drm_gem_lru *lru, struct drm_gem_object = *obj); unsigned long --=20 2.54.0