From: lyude@redhat.com
To: Alexandre Courbot <acourbot@nvidia.com>
Cc: nouveau@lists.freedesktop.org, Gary Guo <gary@garyguo.net>,
Daniel Almeida <daniel.almeida@collabora.com>,
rust-for-linux@vger.kernel.org,
Danilo Krummrich <dakr@kernel.org>,
dri-devel@lists.freedesktop.org,
Matthew Maurer <mmaurer@google.com>,
FUJITA Tomonori <fujita.tomonori@gmail.com>,
Lorenzo Stoakes <lorenzo.stoakes@oracle.com>,
christian.koenig@amd.com, Asahi Lina <lina@asahilina.net>,
Miguel Ojeda <ojeda@kernel.org>,
Andreas Hindborg <a.hindborg@kernel.org>,
Simona Vetter <simona@ffwll.ch>,
Alice Ryhl <aliceryhl@google.com>, Boqun Feng <boqun@kernel.org>,
Sumit Semwal <sumit.semwal@linaro.org>,
Krishna Ketan Rai <prafulrai522@gmail.com>,
linux-media@vger.kernel.org,
Shankari Anand <shankari.ak0208@gmail.com>,
David Airlie <airlied@gmail.com>,
Benno Lossin <lossin@kernel.org>,
Viresh Kumar <viresh.kumar@linaro.org>,
linaro-mm-sig@lists.linaro.org,
Asahi Lina <lina+kernel@asahilina.net>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
kernel@vger.kernel.org
Subject: Re: [PATCH v12 5/5] rust: drm: gem: Add vmap functions to shmem bindings
Date: Mon, 27 Apr 2026 13:29:31 -0400 [thread overview]
Message-ID: <2f8a8b96473d99cee6f33075532a97f956ce21bc.camel@redhat.com> (raw)
In-Reply-To: <DI0MII8J4P2Y.309VKYVMQJNVK@nvidia.com>
On Fri, 2026-04-24 at 00:01 +0900, Alexandre Courbot wrote:
> > dropped before obj.
>
> I am not sure this is enough to solve the double-free issue -
> although my GEM
> knowledge is lacking, so please take this with a grain of salt.
>
> Take an object where we called `sg_table`, so the SGT has been
> created.
>
> When the object is dropped by DRM, `free_callback` is first called.
> It
> calls `drm_gem_shmem_release`, which frees the SGT.
>
> Then, the `Drop` implementation of `Object` is called, and `sgt_res`
> is
> dropped... which attempts to free the SGT again.
>
> I haven't tested that and rely only on a quick look at the code and
> my
> partial understanding, but the correct fix appears to be to clearing
> `sgt_res` in `free_callback`.
Whoops! No you're right, and so is Deborah (she mentioned this
previously, but when reading through it I completely forgot that
free_callback() was in the picture). We can't clear SetOnce, but we can
use mem::take() which should be essentially the same thing. Will fix in
the next respin
WARNING: multiple messages have this Message-ID (diff)
From: lyude@redhat.com
To: Alexandre Courbot <acourbot@nvidia.com>
Cc: nouveau@lists.freedesktop.org, Gary Guo <gary@garyguo.net>,
Daniel Almeida <daniel.almeida@collabora.com>,
rust-for-linux@vger.kernel.org,
Danilo Krummrich <dakr@kernel.org>,
dri-devel@lists.freedesktop.org,
Matthew Maurer <mmaurer@google.com>,
FUJITA Tomonori <fujita.tomonori@gmail.com>,
Lorenzo Stoakes <lorenzo.stoakes@oracle.com>,
christian.koenig@amd.com, Asahi Lina <lina@asahilina.net>,
Miguel Ojeda <ojeda@kernel.org>,
Andreas Hindborg <a.hindborg@kernel.org>,
Simona Vetter <simona@ffwll.ch>,
Alice Ryhl <aliceryhl@google.com>, Boqun Feng <boqun@kernel.org>,
Sumit Semwal <sumit.semwal@linaro.org>,
Krishna Ketan Rai <prafulrai522@gmail.com>,
linux-media@vger.kernel.org,
Shankari Anand <shankari.ak0208@gmail.com>,
Benno Lossin <lossin@kernel.org>,
Viresh Kumar <viresh.kumar@linaro.org>,
linaro-mm-sig@lists.linaro.org,
Asahi Lina <lina+kernel@asahilina.net>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
kernel@vger.kernel.org
Subject: Re: [PATCH v12 5/5] rust: drm: gem: Add vmap functions to shmem bindings
Date: Mon, 27 Apr 2026 13:29:31 -0400 [thread overview]
Message-ID: <2f8a8b96473d99cee6f33075532a97f956ce21bc.camel@redhat.com> (raw)
In-Reply-To: <DI0MII8J4P2Y.309VKYVMQJNVK@nvidia.com>
On Fri, 2026-04-24 at 00:01 +0900, Alexandre Courbot wrote:
> > dropped before obj.
>
> I am not sure this is enough to solve the double-free issue -
> although my GEM
> knowledge is lacking, so please take this with a grain of salt.
>
> Take an object where we called `sg_table`, so the SGT has been
> created.
>
> When the object is dropped by DRM, `free_callback` is first called.
> It
> calls `drm_gem_shmem_release`, which frees the SGT.
>
> Then, the `Drop` implementation of `Object` is called, and `sgt_res`
> is
> dropped... which attempts to free the SGT again.
>
> I haven't tested that and rely only on a quick look at the code and
> my
> partial understanding, but the correct fix appears to be to clearing
> `sgt_res` in `free_callback`.
Whoops! No you're right, and so is Deborah (she mentioned this
previously, but when reading through it I completely forgot that
free_callback() was in the picture). We can't clear SetOnce, but we can
use mem::take() which should be essentially the same thing. Will fix in
the next respin
next prev parent reply other threads:[~2026-04-27 17:29 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-21 23:52 [PATCH v12 0/5] Rust bindings for gem shmem Lyude Paul
2026-04-21 23:52 ` Lyude Paul
2026-04-21 23:52 ` [PATCH v12 1/5] rust: drm: gem: s/device::Device/Device/ for shmem.rs Lyude Paul
2026-04-21 23:52 ` Lyude Paul
2026-04-21 23:52 ` [PATCH v12 2/5] drm/gem/shmem: Introduce __drm_gem_shmem_free_sgt_locked() Lyude Paul
2026-04-21 23:52 ` Lyude Paul
2026-04-22 22:52 ` lyude
2026-04-22 22:52 ` lyude
2026-04-21 23:52 ` [PATCH v12 3/5] drm/gem/shmem: Export drm_gem_shmem_get_pages_sgt_locked() Lyude Paul
2026-04-21 23:52 ` Lyude Paul
2026-04-21 23:52 ` [PATCH v12 4/5] rust: drm: gem: Introduce shmem::SGTable Lyude Paul
2026-04-21 23:52 ` Lyude Paul
2026-04-23 15:01 ` Alexandre Courbot
2026-04-23 15:01 ` Alexandre Courbot
2026-04-23 15:09 ` Gary Guo
2026-04-23 15:09 ` Gary Guo
2026-04-23 15:27 ` Alexandre Courbot
2026-04-23 15:27 ` Alexandre Courbot
2026-04-23 16:13 ` Gary Guo
2026-04-23 16:13 ` Gary Guo
2026-04-24 2:10 ` Alexandre Courbot
2026-04-24 2:10 ` Alexandre Courbot
2026-04-23 15:28 ` Alexandre Courbot
2026-04-23 15:28 ` Alexandre Courbot
2026-04-24 18:13 ` lyude
2026-04-24 18:13 ` lyude
2026-04-24 23:10 ` lyude
2026-04-24 23:10 ` lyude
2026-04-25 2:38 ` Alexandre Courbot
2026-04-25 2:38 ` Alexandre Courbot
2026-04-24 11:08 ` Alexandre Courbot
2026-04-24 11:08 ` Alexandre Courbot
2026-04-21 23:52 ` [PATCH v12 5/5] rust: drm: gem: Add vmap functions to shmem bindings Lyude Paul
2026-04-21 23:52 ` Lyude Paul
2026-04-23 15:01 ` Alexandre Courbot
2026-04-23 15:01 ` Alexandre Courbot
2026-04-27 17:29 ` lyude [this message]
2026-04-27 17:29 ` lyude
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2f8a8b96473d99cee6f33075532a97f956ce21bc.camel@redhat.com \
--to=lyude@redhat.com \
--cc=a.hindborg@kernel.org \
--cc=acourbot@nvidia.com \
--cc=airlied@gmail.com \
--cc=aliceryhl@google.com \
--cc=boqun@kernel.org \
--cc=christian.koenig@amd.com \
--cc=dakr@kernel.org \
--cc=daniel.almeida@collabora.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=fujita.tomonori@gmail.com \
--cc=gary@garyguo.net \
--cc=gregkh@linuxfoundation.org \
--cc=kernel@vger.kernel.org \
--cc=lina+kernel@asahilina.net \
--cc=lina@asahilina.net \
--cc=linaro-mm-sig@lists.linaro.org \
--cc=linux-media@vger.kernel.org \
--cc=lorenzo.stoakes@oracle.com \
--cc=lossin@kernel.org \
--cc=mmaurer@google.com \
--cc=nouveau@lists.freedesktop.org \
--cc=ojeda@kernel.org \
--cc=prafulrai522@gmail.com \
--cc=rust-for-linux@vger.kernel.org \
--cc=shankari.ak0208@gmail.com \
--cc=simona@ffwll.ch \
--cc=sumit.semwal@linaro.org \
--cc=viresh.kumar@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.