From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3292E4EF146; Tue, 13 Oct 2026 11:54:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791892443; cv=none; b=AD3hkmCV3109ZMSP5LrIcMcuAVMk2ml5h2epWJhaBRRUrb5QA+2yBRkNyiEFxKmIKD296K+4d7PXKqSwOAYbueuMhfoqBN7w0060PloPhASio4lSn+Iy2zVWju6XiD1CA7NPRxMaShgWrG4PvB28GwalnG1Cs8gF1MrLykm/KYw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791892443; c=relaxed/simple; bh=PysydoEr5I/Mu4eCOBFIAdmV16/1O21IBFWQ13kv4Z8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=JxOEhTZJS99fin7BMWPCERFcYtU+GcfMjjN9zlpjS3oDqaUxqWvaKJ/e0aWdCTx89Uo7soM1GEFSBSmlfuGhn3V8D+eb1MBXvgAu0ugICOQVspWkcbcA3Eq8126VeZitTB1p5dFnv0mbtVTOGSBJWlkhwWq7bUzZvcG6X+4Am1I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KZtnA7U5; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="KZtnA7U5" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AA35A1F000FF; Tue, 13 Oct 2026 11:54:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1791892441; bh=2prdv0oSFig/kI9XmqL8UNYwfLLrGyDdSR1Mw0j2PGs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=KZtnA7U5IJIMrBmrFhbiIwLApeIhLYF1WLpe6vwP3i5sgG6bZWA1XsSm30Ko+uXl8 JBjHl8BJEN1NGpbgEBWnxa/L0LlXvbSh7FiH74L1wjBKjH1qFFzGxWQp2JLGT4vOto f6pmWp4dy7Ts0ERSZxUXHVFZlyvZdR/S4csy7CU4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Song Li , Fan Wu , =?UTF-8?q?Ma=C3=ADra=20Canal?= Subject: [PATCH 7.2 130/281] drm/vc4: drain the hangcheck timer and works on V3D unbind Date: Tue, 13 Oct 2026 13:37:26 +0200 Message-ID: <20261013112858.305872275@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261013112855.045212108@linuxfoundation.org> References: <20261013112855.045212108@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 7.2-stable review patch. If anyone has any objections, please let me know. ------------------ From: Fan Wu commit 94cf5971b1d04c6382437387c4dc3836cc7a1437 upstream. Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown: vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy() runs from the drm-managed release, after vc4_v3d_unbind() has already uninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed by then reads V3D registers through the NULL vc4->v3d pointer, and the late callbacks run on the vc4_dev embedding them after it has been freed. Drain them in vc4_v3d_unbind(): shut the timer down and cancel reset_work before the interrupt is taken down, because its vc4_irq_reset() re-enables it, then flush job_done_work so that completions queued at teardown still release their jobs. This issue was found by an in-house static analysis tool. Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.") Cc: stable@vger.kernel.org # 6.2+ Assisted-by: Codex:gpt-5.6 Co-developed-by: Song Li Signed-off-by: Song Li Signed-off-by: Fan Wu Link: https://patch.msgid.link/20260915095103.156007-1-fanwu01@zju.edu.cn Reviewed-by: Maíra Canal Signed-off-by: Maíra Canal Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/vc4/vc4_v3d.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/drivers/gpu/drm/vc4/vc4_v3d.c +++ b/drivers/gpu/drm/vc4/vc4_v3d.c @@ -9,6 +9,7 @@ #include #include #include +#include #include @@ -497,8 +498,15 @@ static void vc4_v3d_unbind(struct device struct drm_device *drm = data; struct vc4_dev *vc4 = to_vc4_dev(drm); + /* A straggler vc4_reset() re-enables the interrupt. */ + timer_shutdown_sync(&vc4->hangcheck.timer); + cancel_work_sync(&vc4->hangcheck.reset_work); + vc4_irq_uninstall(drm); + /* Flush rather than cancel, so queued completions release their jobs. */ + flush_work(&vc4->job_done_work); + /* Disable the binner's overflow memory address, so the next * driver probe (if any) doesn't try to reuse our old * allocation.