Re: [PATCH] drm/i915/gt: Do not destroy uninitialized timer

[Jani Nikula <jani.nikula@linux.intel.com>]

On Tue, 29 Sep 2026, Krzysztof Karas <krzysztof.karas@intel.com> wrote:
> If intel_ring_begin() fails in live_emit_pte_full_ring(), then
> cleanup is performed on an uninitialized timer.
>
> Check if the timer has been set up, before trying to remove it.
>
> Assisted-by: Copilot-Claude-Opus-5
> Signed-off-by: Krzysztof Karas <krzysztof.karas@intel.com>
> ---
>  drivers/gpu/drm/i915/gt/selftest_migrate.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/gt/selftest_migrate.c b/drivers/gpu/drm/i915/gt/selftest_migrate.c
> index 5b986a7687d9..6793ba028146 100644
> --- a/drivers/gpu/drm/i915/gt/selftest_migrate.c
> +++ b/drivers/gpu/drm/i915/gt/selftest_migrate.c
> @@ -552,6 +552,7 @@ static int live_emit_pte_full_ring(void *arg)
>  	struct intel_context *ce;
>  	struct i915_request *rq, *prev;
>  	struct spinner_timer st;
> +	bool timer_set = false;
>  	struct sgt_dma it;
>  	int len, sz, err;
>  	u32 *cs;
> @@ -641,6 +642,7 @@ static int live_emit_pte_full_ring(void *arg)
>  
>  	timer_setup_on_stack(&st.timer, spinner_kill, 0);
>  	mod_timer(&st.timer, jiffies + 2 * HZ);
> +	timer_set = true;
>  
>  	/*
>  	 * This should wait for the spinner to be killed, otherwise we should go
> @@ -660,8 +662,10 @@ static int live_emit_pte_full_ring(void *arg)
>  
>  out_rq:
>  	i915_request_add(rq); /* GEM_BUG_ON(rq->reserved_space > ring->space)? */
> -	timer_delete_sync(&st.timer);
> -	timer_destroy_on_stack(&st.timer);
> +	if (timer_set) {
> +		timer_delete_sync(&st.timer);
> +		timer_destroy_on_stack(&st.timer);
> +	}

Usually you'd have separate goto labels for the cleanup you do. Like, we
have "out_unpin" for when "out_rq" is not needed. We should have one for
timer cleanup as well.

BR,
Jani.

>  out_unpin:
>  	intel_context_unpin(ce);
>  out_put:

-- 
Jani Nikula, Intel