From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 30AD63A5430; Sat, 17 Oct 2026 17:16:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792257382; cv=none; b=jHlTvyiuYKzvH5j1nVXwtD/8yV6KJhIJBmy5UMRZlrpgCnvVXj6+JxFTYQm1EZ0suaFtQnIaDg7H2pYc0LMfF2V5xGH9S9gDsXIzV1EKw8DxgQC4MPloY3TPIwJ3c4n0PkJdwZ3B6E89uWd2ZqprDLpmLQIGvTcJ3JA0uI5NZvE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792257382; c=relaxed/simple; bh=WZ+M58KteKtYKg4ADtZ9YYHYluMJQ20TO4WGfsXscqM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=cEpJAeGaSwoalvybfAZz/QQ35zFMESdVp48nifHmPsUukRRafGD+0zh7BaEs9bMrmFWK3QxzqWM2nHic34aw7me+Bd7XMPL2HitqmjX7dWiN3baaR26oP9cIcI3RyuZl/RaurfmQpH+sQX0ZDXmGi2fMjIbrxVqzXwadOJB772k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=YwVaMquz; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="YwVaMquz" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7D9571F000C5; Sat, 17 Oct 2026 17:16:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792257380; bh=m8Gjn2I8aQtvHT/cMcOJ3s70jT+pA/wNv5PX/6dNsPg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=YwVaMquz8Rzv3Ps4oaJv2xJBxhEhNphWet/RsfPI2IIXb9sRD5TPh+K8TVWBwivPC qN6HrI+euN9895wghTMC4z6IClfISzaFYlLgcUWeYAXbiouGLwQU8A1rbHF7TyKDYC qThOML8gXkOd/J79+B9aWmZ4mPP0QCtK9jRJoUxU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Song Li , Fan Wu , =?UTF-8?q?Ma=C3=ADra=20Canal?= Subject: [PATCH 6.6 0524/1674] drm/vc4: drain the hangcheck timer and works on V3D unbind Date: Sat, 17 Oct 2026 17:46:36 +0200 Message-ID: <20261017160444.557991476@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261017160431.119607952@linuxfoundation.org> References: <20261017160431.119607952@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Fan Wu commit 94cf5971b1d04c6382437387c4dc3836cc7a1437 upstream. Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown: vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy() runs from the drm-managed release, after vc4_v3d_unbind() has already uninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed by then reads V3D registers through the NULL vc4->v3d pointer, and the late callbacks run on the vc4_dev embedding them after it has been freed. Drain them in vc4_v3d_unbind(): shut the timer down and cancel reset_work before the interrupt is taken down, because its vc4_irq_reset() re-enables it, then flush job_done_work so that completions queued at teardown still release their jobs. This issue was found by an in-house static analysis tool. Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.") Cc: stable@vger.kernel.org # 6.2+ Assisted-by: Codex:gpt-5.6 Co-developed-by: Song Li Signed-off-by: Song Li Signed-off-by: Fan Wu Link: https://patch.msgid.link/20260915095103.156007-1-fanwu01@zju.edu.cn Reviewed-by: Maíra Canal Signed-off-by: Maíra Canal Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/vc4/vc4_v3d.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/drivers/gpu/drm/vc4/vc4_v3d.c +++ b/drivers/gpu/drm/vc4/vc4_v3d.c @@ -9,6 +9,7 @@ #include #include #include +#include #include "vc4_drv.h" #include "vc4_regs.h" @@ -507,8 +508,15 @@ static void vc4_v3d_unbind(struct device struct drm_device *drm = dev_get_drvdata(master); struct vc4_dev *vc4 = to_vc4_dev(drm); + /* A straggler vc4_reset() re-enables the interrupt. */ + timer_shutdown_sync(&vc4->hangcheck.timer); + cancel_work_sync(&vc4->hangcheck.reset_work); + vc4_irq_uninstall(drm); + /* Flush rather than cancel, so queued completions release their jobs. */ + flush_work(&vc4->job_done_work); + /* Disable the binner's overflow memory address, so the next * driver probe (if any) doesn't try to reuse our old * allocation.