From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 86BEF372EF5; Fri, 7 Aug 2026 15:15:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786115705; cv=none; b=e96ESkAbc6QvdYx8IjcHrra1a4WYrcDl15jkZNAzhuofxWQLr5o4ypbXbRIpAPkf+Y5h4yZ+Ixy/JOtpHI0u0mbEAaiZfT34FgsnHF/oy9ICmQuZZDYmqq9+zBBxPIXEB7B1hgLob+ItdPlHE4TQsaADcNTIvoRN0wSJOrWijaw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786115705; c=relaxed/simple; bh=5civfpDxJwANR4eZVkHXJwxCKKLMqn8QVbN22Xafbrs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Uq61ix/521ZAFDolG3isQEf1JedXDNgO/zd9jfQ3vTnQW/3BH/T24qsPMY0c2yGz04sFNW3xvBa5u9jZ2rQiCo9xsH7ekGwEPO9mDxJbV95eEiGEruSdRV8dtn90avNVjBcseseXDU4a0Vus2lBiKj70HphLyru7vBvopoedbbA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=pdg5uOOZ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="pdg5uOOZ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E26621F000E9; Fri, 7 Aug 2026 15:15:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786115704; bh=MMZiVyIKENlN5cWlrEWqx7y5i749frVdF7NV181toAw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=pdg5uOOZBa63Qak3Q1GChE01s1V63kEpz4ZKprnfzgMIMMtNg/wAwoWThzqoumMZh M06E+QGQxWNeNQidDMdpXJ6ADUj9uTO6tfztYZdBj09uIF4PleR7nBnmpwu/czw6HI G5PYQ61huWoK+XreXhlU6z+WwBK4/KV09ubawRi4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Zack Rusin , Ian Forbes Subject: [PATCH 6.18 333/396] drm/vmwgfx: take fman->lock around fence list mutation in fifo_down Date: Fri, 7 Aug 2026 16:38:13 +0200 Message-ID: <20260807143431.472691792@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260807143424.272339768@linuxfoundation.org> References: <20260807143424.272339768@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Zack Rusin commit 250af2e8c3e90dc978e062a936b633870a22e660 upstream. vmw_fence_fifo_down() drops fman->lock to wait on a fence and, on timeout, mutates fman->fence_list via list_del_init() and signals the fence without re-acquiring the lock. __vmw_fences_update() walks and removes entries from the same list under fman->lock from any other waiter, the fence-IRQ thread, or vmw_fences_update(), so the unlocked list_del_init() can corrupt the list head. Re-take fman->lock before manipulating fence->head and use dma_fence_signal_locked(). Wrap the locked signalling in dma_fence_begin_signalling() / dma_fence_end_signalling() so the lockdep annotation that dma_fence_signal() previously provided is preserved (the same pattern as __vmw_fences_update()). dma_fence_put() is moved outside the lock to avoid a recursive acquire from vmw_fence_obj_destroy(), which also takes fman->lock. Fixes: ae2a104058e2 ("vmwgfx: Implement fence objects") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Zack Rusin Reviewed-by: Ian Forbes Link: https://patch.msgid.link/20260505222728.519626-5-zack.rusin@broadcom.com Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c @@ -366,13 +366,24 @@ void vmw_fence_fifo_down(struct vmw_fenc ret = vmw_fence_obj_wait(fence, false, false, VMW_FENCE_WAIT_TIMEOUT); + spin_lock(&fman->lock); if (unlikely(ret != 0)) { + bool cookie = dma_fence_begin_signalling(); + list_del_init(&fence->head); - dma_fence_signal(&fence->base); + if (fence->waiter_added) { + vmw_seqno_waiter_remove(fman->dev_priv); + fence->waiter_added = false; + } + dma_fence_signal_locked(&fence->base); + dma_fence_end_signalling(cookie); } BUG_ON(!list_empty(&fence->head)); + spin_unlock(&fman->lock); + dma_fence_put(&fence->base); + spin_lock(&fman->lock); } spin_unlock(&fman->lock);