public inbox for intel-xe@lists.freedesktop.org
 help / color / mirror / Atom feed
From: Ville Syrjala <ville.syrjala@linux.intel.com>
To: intel-gfx@lists.freedesktop.org
Cc: intel-xe@lists.freedesktop.org,
	"Jani Nikula" <jani.nikula@intel.com>,
	"Jouni Högander" <jouni.hogander@intel.com>,
	"Maarten Lankhorst" <maarten.lankhorst@linux.intel.com>
Subject: [PATCH v3 1/7] drm/i915: Clear i915->display when no longer valid
Date: Thu, 16 Apr 2026 00:04:05 +0300	[thread overview]
Message-ID: <20260415210411.24750-2-ville.syrjala@linux.intel.com> (raw)
In-Reply-To: <20260415210411.24750-1-ville.syrjala@linux.intel.com>

From: Ville Syrjälä <ville.syrjala@linux.intel.com>

Don't leave a stale i915->display pointer hanging around after
the display driver has been torn down. Apparently the gt code
calls into the reset codepaths after this, and if the display
pointer is still around we may try to access freed memory.

The whole teardown sequence here seems rather suspect. Why is
display done first and then everything else via the managed
release? Who the heck knows. Someone really needs to dig into
this stuff and figure out the proper init/cleanup sequence for
both i915 (real and mock) and xe...

Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Jouni Högander <jouni.hogander@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
---
 drivers/gpu/drm/i915/i915_driver.c               | 1 +
 drivers/gpu/drm/i915/selftests/mock_gem_device.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/i915/i915_driver.c b/drivers/gpu/drm/i915/i915_driver.c
index 195e34acef30..d31819758f3d 100644
--- a/drivers/gpu/drm/i915/i915_driver.c
+++ b/drivers/gpu/drm/i915/i915_driver.c
@@ -310,6 +310,7 @@ static void i915_driver_late_release(struct drm_i915_private *dev_priv)
 	i915_params_free(&dev_priv->params);
 
 	intel_display_device_remove(display);
+	dev_priv->display = NULL;
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/selftests/mock_gem_device.c b/drivers/gpu/drm/i915/selftests/mock_gem_device.c
index 27dc0e40a8d7..796c9b070e41 100644
--- a/drivers/gpu/drm/i915/selftests/mock_gem_device.c
+++ b/drivers/gpu/drm/i915/selftests/mock_gem_device.c
@@ -277,6 +277,7 @@ void mock_destroy_device(struct drm_i915_private *i915)
 	struct device *dev = i915->drm.dev;
 
 	intel_display_device_remove(i915->display);
+	i915->display = NULL;
 
 	devres_release_group(dev, NULL);
 	put_device(dev);
-- 
2.52.0


  reply	other threads:[~2026-04-15 21:04 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-15 21:04 [PATCH v3 0/7] drm/i915/reset: Expose "display_reset_count" in debugfs Ville Syrjala
2026-04-15 21:04 ` Ville Syrjala [this message]
2026-04-16  8:17   ` [PATCH v3 1/7] drm/i915: Clear i915->display when no longer valid Jani Nikula
2026-04-15 21:04 ` [PATCH v3 2/7] drm/xe: Clear xe->display " Ville Syrjala
2026-04-16 15:49   ` Jani Nikula
2026-04-15 21:04 ` [PATCH v3 3/7] drm/i915/reset: Reorganize display reset code Ville Syrjala
2026-04-15 21:04 ` [PATCH v3 4/7] drm/i915/reset: Move pending_fb_pin handling to i915 Ville Syrjala
2026-04-15 21:04 ` [PATCH v3 5/7] drm/xe/display: Add init_clock_gating.h stubs Ville Syrjala
2026-04-15 21:04 ` [PATCH v3 6/7] drm/i915/reset: Add "display_reset_count" debugfs file Ville Syrjala
2026-04-15 21:04 ` [PATCH v3 7/7] drm/i915/reset: Disable execlist per-engine reset for display reset tests Ville Syrjala
2026-04-15 21:11 ` ✓ CI.KUnit: success for drm/i915/reset: Expose "display_reset_count" in debugfs (rev4) Patchwork
2026-04-15 22:07 ` ✓ Xe.CI.BAT: " Patchwork
2026-04-15 23:44 ` ✓ Xe.CI.FULL: " Patchwork

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260415210411.24750-2-ville.syrjala@linux.intel.com \
    --to=ville.syrjala@linux.intel.com \
    --cc=intel-gfx@lists.freedesktop.org \
    --cc=intel-xe@lists.freedesktop.org \
    --cc=jani.nikula@intel.com \
    --cc=jouni.hogander@intel.com \
    --cc=maarten.lankhorst@linux.intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox