[PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it

[PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Mutexes must be unlocked before these are destroyed. This has been detected
by the Clang thread-safety analyzer.

Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Yang Wang <kevinyang.wang@amd.com>
Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Fixes: f5e4cc8461c4 ("drm/amdgpu: implement RAS ACA driver framework")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
index afe5ca81beec..db7858fe0c3d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
@@ -641,6 +641,7 @@ static void aca_error_fini(struct aca_error *aerr)
 		aca_bank_error_remove(aerr, bank_error);
 
 out_unlock:
+	mutex_unlock(&aerr->lock);
 	mutex_destroy(&aerr->lock);
 }
 

RE: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it

[Wang, Yang(Kevin)]

[AMD Official Use Only - AMD Internal Distribution Only]

Reviewed-by: Yang Wang <kevinyang.wang@amd.com>

Best Regards,
Kevin

-----Original Message-----
From: Bart Van Assche <bart.vanassche@linux.dev>
Sent: Tuesday, February 24, 2026 6:00 AM
To: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>; Will Deacon <will@kernel.org>; Boqun Feng <boqun@kernel.org>; Waiman Long <longman@redhat.com>; linux-kernel@vger.kernel.org; Marco Elver <elver@google.com>; Christoph Hellwig <hch@lst.de>; Steven Rostedt <rostedt@goodmis.org>; Nick Desaulniers <ndesaulniers@google.com>; Nathan Chancellor <nathan@kernel.org>; Kees Cook <kees@kernel.org>; Jann Horn <jannh@google.com>; Bart Van Assche <bvanassche@acm.org>; Deucher, Alexander <Alexander.Deucher@amd.com>; Koenig, Christian <Christian.Koenig@amd.com>; Wang, Yang(Kevin) <KevinYang.Wang@amd.com>; Zhang, Hawking <Hawking.Zhang@amd.com>; amd-gfx@lists.freedesktop.org
Subject: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it

[You don't often get email from bart.vanassche@linux.dev. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

From: Bart Van Assche <bvanassche@acm.org>

Mutexes must be unlocked before these are destroyed. This has been detected by the Clang thread-safety analyzer.

Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Yang Wang <kevinyang.wang@amd.com>
Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Fixes: f5e4cc8461c4 ("drm/amdgpu: implement RAS ACA driver framework")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
index afe5ca81beec..db7858fe0c3d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
@@ -641,6 +641,7 @@ static void aca_error_fini(struct aca_error *aerr)
                aca_bank_error_remove(aerr, bank_error);

 out_unlock:
+       mutex_unlock(&aerr->lock);
        mutex_destroy(&aerr->lock);
 }

Re: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it

[Alex Deucher]

Applied.  Thanks!

On Mon, Feb 23, 2026 at 10:59 PM Wang, Yang(Kevin)
<KevinYang.Wang@amd.com> wrote:
>
> [AMD Official Use Only - AMD Internal Distribution Only]
>
> Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
>
> Best Regards,
> Kevin
>
> -----Original Message-----
> From: Bart Van Assche <bart.vanassche@linux.dev>
> Sent: Tuesday, February 24, 2026 6:00 AM
> To: Peter Zijlstra <peterz@infradead.org>
> Cc: Ingo Molnar <mingo@redhat.com>; Will Deacon <will@kernel.org>; Boqun Feng <boqun@kernel.org>; Waiman Long <longman@redhat.com>; linux-kernel@vger.kernel.org; Marco Elver <elver@google.com>; Christoph Hellwig <hch@lst.de>; Steven Rostedt <rostedt@goodmis.org>; Nick Desaulniers <ndesaulniers@google.com>; Nathan Chancellor <nathan@kernel.org>; Kees Cook <kees@kernel.org>; Jann Horn <jannh@google.com>; Bart Van Assche <bvanassche@acm.org>; Deucher, Alexander <Alexander.Deucher@amd.com>; Koenig, Christian <Christian.Koenig@amd.com>; Wang, Yang(Kevin) <KevinYang.Wang@amd.com>; Zhang, Hawking <Hawking.Zhang@amd.com>; amd-gfx@lists.freedesktop.org
> Subject: [PATCH 07/62] drm/amdgpu: Unlock a mutex before destroying it
>
> [You don't often get email from bart.vanassche@linux.dev. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> From: Bart Van Assche <bvanassche@acm.org>
>
> Mutexes must be unlocked before these are destroyed. This has been detected by the Clang thread-safety analyzer.
>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Christian König <christian.koenig@amd.com>
> Cc: Yang Wang <kevinyang.wang@amd.com>
> Cc: Hawking Zhang <Hawking.Zhang@amd.com>
> Cc: amd-gfx@lists.freedesktop.org
> Fixes: f5e4cc8461c4 ("drm/amdgpu: implement RAS ACA driver framework")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
> index afe5ca81beec..db7858fe0c3d 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
> @@ -641,6 +641,7 @@ static void aca_error_fini(struct aca_error *aerr)
>                 aca_bank_error_remove(aerr, bank_error);
>
>  out_unlock:
> +       mutex_unlock(&aerr->lock);
>         mutex_destroy(&aerr->lock);
>  }
>

[PATCH 08/62] drm/amdgpu: Fix locking bugs in error paths

[Bart Van Assche]

From: Bart Van Assche <bvanassche@acm.org>

Do not unlock psp->ras_context.mutex if it has not been locked. This has
been detected by the Clang thread-safety analyzer.

Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: YiPeng Chai <YiPeng.Chai@amd.com>
Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Fixes: b3fb79cda568 ("drm/amdgpu: add mutex to protect ras shared memory")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
index 6e8aad91bcd3..0d3c18f04ac3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
@@ -332,13 +332,13 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 	if (!context || !context->initialized) {
 		dev_err(adev->dev, "TA is not initialized\n");
 		ret = -EINVAL;
-		goto err_free_shared_buf;
+		goto free_shared_buf;
 	}
 
 	if (!psp->ta_funcs || !psp->ta_funcs->fn_ta_invoke) {
 		dev_err(adev->dev, "Unsupported function to invoke TA\n");
 		ret = -EOPNOTSUPP;
-		goto err_free_shared_buf;
+		goto free_shared_buf;
 	}
 
 	context->session_id = ta_id;
@@ -346,7 +346,7 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 	mutex_lock(&psp->ras_context.mutex);
 	ret = prep_ta_mem_context(&context->mem_context, shared_buf, shared_buf_len);
 	if (ret)
-		goto err_free_shared_buf;
+		goto unlock;
 
 	ret = psp_fn_ta_invoke(psp, cmd_id);
 	if (ret || context->resp_status) {
@@ -354,15 +354,17 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 			ret, context->resp_status);
 		if (!ret) {
 			ret = -EINVAL;
-			goto err_free_shared_buf;
+			goto unlock;
 		}
 	}
 
 	if (copy_to_user((char *)&buf[copy_pos], context->mem_context.shared_buf, shared_buf_len))
 		ret = -EFAULT;
 
-err_free_shared_buf:
+unlock:
 	mutex_unlock(&psp->ras_context.mutex);
+
+free_shared_buf:
 	kfree(shared_buf);
 
 	return ret;

[PATCH 08/62] drm/amdgpu: Fix locking bugs in error paths

[Bart Van Assche]

Do not unlock psp->ras_context.mutex if it has not been locked. This has
been detected by the Clang thread-safety analyzer.

Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: YiPeng Chai <YiPeng.Chai@amd.com>
Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Fixes: b3fb79cda568 ("drm/amdgpu: add mutex to protect ras shared memory")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
index 6e8aad91bcd3..0d3c18f04ac3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
@@ -332,13 +332,13 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 	if (!context || !context->initialized) {
 		dev_err(adev->dev, "TA is not initialized\n");
 		ret = -EINVAL;
-		goto err_free_shared_buf;
+		goto free_shared_buf;
 	}
 
 	if (!psp->ta_funcs || !psp->ta_funcs->fn_ta_invoke) {
 		dev_err(adev->dev, "Unsupported function to invoke TA\n");
 		ret = -EOPNOTSUPP;
-		goto err_free_shared_buf;
+		goto free_shared_buf;
 	}
 
 	context->session_id = ta_id;
@@ -346,7 +346,7 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 	mutex_lock(&psp->ras_context.mutex);
 	ret = prep_ta_mem_context(&context->mem_context, shared_buf, shared_buf_len);
 	if (ret)
-		goto err_free_shared_buf;
+		goto unlock;
 
 	ret = psp_fn_ta_invoke(psp, cmd_id);
 	if (ret || context->resp_status) {
@@ -354,15 +354,17 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 			ret, context->resp_status);
 		if (!ret) {
 			ret = -EINVAL;
-			goto err_free_shared_buf;
+			goto unlock;
 		}
 	}
 
 	if (copy_to_user((char *)&buf[copy_pos], context->mem_context.shared_buf, shared_buf_len))
 		ret = -EFAULT;
 
-err_free_shared_buf:
+unlock:
 	mutex_unlock(&psp->ras_context.mutex);
+
+free_shared_buf:
 	kfree(shared_buf);
 
 	return ret;

Re: [PATCH 08/62] drm/amdgpu: Fix locking bugs in error paths

[Christian König]

On 2/23/26 22:50, Bart Van Assche wrote:
> Do not unlock psp->ras_context.mutex if it has not been locked. This has
> been detected by the Clang thread-safety analyzer.
> 
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Christian König <christian.koenig@amd.com>
> Cc: YiPeng Chai <YiPeng.Chai@amd.com>
> Cc: Hawking Zhang <Hawking.Zhang@amd.com>
> Cc: amd-gfx@lists.freedesktop.org
> Fixes: b3fb79cda568 ("drm/amdgpu: add mutex to protect ras shared memory")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>

Acked-by: Christian König <christian.koenig@amd.com>

> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
> index 6e8aad91bcd3..0d3c18f04ac3 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
> @@ -332,13 +332,13 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
>  	if (!context || !context->initialized) {
>  		dev_err(adev->dev, "TA is not initialized\n");
>  		ret = -EINVAL;
> -		goto err_free_shared_buf;
> +		goto free_shared_buf;
>  	}
>  
>  	if (!psp->ta_funcs || !psp->ta_funcs->fn_ta_invoke) {
>  		dev_err(adev->dev, "Unsupported function to invoke TA\n");
>  		ret = -EOPNOTSUPP;
> -		goto err_free_shared_buf;
> +		goto free_shared_buf;
>  	}
>  
>  	context->session_id = ta_id;
> @@ -346,7 +346,7 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
>  	mutex_lock(&psp->ras_context.mutex);
>  	ret = prep_ta_mem_context(&context->mem_context, shared_buf, shared_buf_len);
>  	if (ret)
> -		goto err_free_shared_buf;
> +		goto unlock;
>  
>  	ret = psp_fn_ta_invoke(psp, cmd_id);
>  	if (ret || context->resp_status) {
> @@ -354,15 +354,17 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
>  			ret, context->resp_status);
>  		if (!ret) {
>  			ret = -EINVAL;
> -			goto err_free_shared_buf;
> +			goto unlock;
>  		}
>  	}
>  
>  	if (copy_to_user((char *)&buf[copy_pos], context->mem_context.shared_buf, shared_buf_len))
>  		ret = -EFAULT;
>  
> -err_free_shared_buf:
> +unlock:
>  	mutex_unlock(&psp->ras_context.mutex);
> +
> +free_shared_buf:
>  	kfree(shared_buf);
>  
>  	return ret;

Re: [PATCH 08/62] drm/amdgpu: Fix locking bugs in error paths

[Alex Deucher]

Applied.  Thanks!

On Tue, Feb 24, 2026 at 3:54 AM Christian König
<christian.koenig@amd.com> wrote:
>
> On 2/23/26 22:50, Bart Van Assche wrote:
> > Do not unlock psp->ras_context.mutex if it has not been locked. This has
> > been detected by the Clang thread-safety analyzer.
> >
> > Cc: Alex Deucher <alexander.deucher@amd.com>
> > Cc: Christian König <christian.koenig@amd.com>
> > Cc: YiPeng Chai <YiPeng.Chai@amd.com>
> > Cc: Hawking Zhang <Hawking.Zhang@amd.com>
> > Cc: amd-gfx@lists.freedesktop.org
> > Fixes: b3fb79cda568 ("drm/amdgpu: add mutex to protect ras shared memory")
> > Signed-off-by: Bart Van Assche <bvanassche@acm.org>
>
> Acked-by: Christian König <christian.koenig@amd.com>
>
> > ---
> >  drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 12 +++++++-----
> >  1 file changed, 7 insertions(+), 5 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
> > index 6e8aad91bcd3..0d3c18f04ac3 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
> > @@ -332,13 +332,13 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
> >       if (!context || !context->initialized) {
> >               dev_err(adev->dev, "TA is not initialized\n");
> >               ret = -EINVAL;
> > -             goto err_free_shared_buf;
> > +             goto free_shared_buf;
> >       }
> >
> >       if (!psp->ta_funcs || !psp->ta_funcs->fn_ta_invoke) {
> >               dev_err(adev->dev, "Unsupported function to invoke TA\n");
> >               ret = -EOPNOTSUPP;
> > -             goto err_free_shared_buf;
> > +             goto free_shared_buf;
> >       }
> >
> >       context->session_id = ta_id;
> > @@ -346,7 +346,7 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
> >       mutex_lock(&psp->ras_context.mutex);
> >       ret = prep_ta_mem_context(&context->mem_context, shared_buf, shared_buf_len);
> >       if (ret)
> > -             goto err_free_shared_buf;
> > +             goto unlock;
> >
> >       ret = psp_fn_ta_invoke(psp, cmd_id);
> >       if (ret || context->resp_status) {
> > @@ -354,15 +354,17 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
> >                       ret, context->resp_status);
> >               if (!ret) {
> >                       ret = -EINVAL;
> > -                     goto err_free_shared_buf;
> > +                     goto unlock;
> >               }
> >       }
> >
> >       if (copy_to_user((char *)&buf[copy_pos], context->mem_context.shared_buf, shared_buf_len))
> >               ret = -EFAULT;
> >
> > -err_free_shared_buf:
> > +unlock:
> >       mutex_unlock(&psp->ras_context.mutex);
> > +
> > +free_shared_buf:
> >       kfree(shared_buf);
> >
> >       return ret;
>

[PATCH 08/62] drm/amdgpu: Fix locking bugs in error paths

[Bart Van Assche]

Do not unlock psp->ras_context.mutex if it has not been locked. This has
been detected by the Clang thread-safety analyzer.

Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: YiPeng Chai <YiPeng.Chai@amd.com>
Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Fixes: b3fb79cda568 ("drm/amdgpu: add mutex to protect ras shared memory")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
index 6e8aad91bcd3..0d3c18f04ac3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
@@ -332,13 +332,13 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 	if (!context || !context->initialized) {
 		dev_err(adev->dev, "TA is not initialized\n");
 		ret = -EINVAL;
-		goto err_free_shared_buf;
+		goto free_shared_buf;
 	}
 
 	if (!psp->ta_funcs || !psp->ta_funcs->fn_ta_invoke) {
 		dev_err(adev->dev, "Unsupported function to invoke TA\n");
 		ret = -EOPNOTSUPP;
-		goto err_free_shared_buf;
+		goto free_shared_buf;
 	}
 
 	context->session_id = ta_id;
@@ -346,7 +346,7 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 	mutex_lock(&psp->ras_context.mutex);
 	ret = prep_ta_mem_context(&context->mem_context, shared_buf, shared_buf_len);
 	if (ret)
-		goto err_free_shared_buf;
+		goto unlock;
 
 	ret = psp_fn_ta_invoke(psp, cmd_id);
 	if (ret || context->resp_status) {
@@ -354,15 +354,17 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size
 			ret, context->resp_status);
 		if (!ret) {
 			ret = -EINVAL;
-			goto err_free_shared_buf;
+			goto unlock;
 		}
 	}
 
 	if (copy_to_user((char *)&buf[copy_pos], context->mem_context.shared_buf, shared_buf_len))
 		ret = -EFAULT;
 
-err_free_shared_buf:
+unlock:
 	mutex_unlock(&psp->ras_context.mutex);
+
+free_shared_buf:
 	kfree(shared_buf);
 
 	return ret;