From: Ville Syrjala <ville.syrjala@linux.intel.com>
To: intel-gfx@lists.freedesktop.org
Cc: intel-xe@lists.freedesktop.org,
"Jani Nikula" <jani.nikula@intel.com>,
"Jouni Högander" <jouni.hogander@intel.com>,
"Maarten Lankhorst" <maarten.lankhorst@linux.intel.com>
Subject: [PATCH v3 1/7] drm/i915: Clear i915->display when no longer valid
Date: Thu, 16 Apr 2026 00:04:05 +0300 [thread overview]
Message-ID: <20260415210411.24750-2-ville.syrjala@linux.intel.com> (raw)
In-Reply-To: <20260415210411.24750-1-ville.syrjala@linux.intel.com>
From: Ville Syrjälä <ville.syrjala@linux.intel.com>
Don't leave a stale i915->display pointer hanging around after
the display driver has been torn down. Apparently the gt code
calls into the reset codepaths after this, and if the display
pointer is still around we may try to access freed memory.
The whole teardown sequence here seems rather suspect. Why is
display done first and then everything else via the managed
release? Who the heck knows. Someone really needs to dig into
this stuff and figure out the proper init/cleanup sequence for
both i915 (real and mock) and xe...
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Jouni Högander <jouni.hogander@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
---
drivers/gpu/drm/i915/i915_driver.c | 1 +
drivers/gpu/drm/i915/selftests/mock_gem_device.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/i915/i915_driver.c b/drivers/gpu/drm/i915/i915_driver.c
index 195e34acef30..d31819758f3d 100644
--- a/drivers/gpu/drm/i915/i915_driver.c
+++ b/drivers/gpu/drm/i915/i915_driver.c
@@ -310,6 +310,7 @@ static void i915_driver_late_release(struct drm_i915_private *dev_priv)
i915_params_free(&dev_priv->params);
intel_display_device_remove(display);
+ dev_priv->display = NULL;
}
/**
diff --git a/drivers/gpu/drm/i915/selftests/mock_gem_device.c b/drivers/gpu/drm/i915/selftests/mock_gem_device.c
index 27dc0e40a8d7..796c9b070e41 100644
--- a/drivers/gpu/drm/i915/selftests/mock_gem_device.c
+++ b/drivers/gpu/drm/i915/selftests/mock_gem_device.c
@@ -277,6 +277,7 @@ void mock_destroy_device(struct drm_i915_private *i915)
struct device *dev = i915->drm.dev;
intel_display_device_remove(i915->display);
+ i915->display = NULL;
devres_release_group(dev, NULL);
put_device(dev);
--
2.52.0
next prev parent reply other threads:[~2026-04-15 21:04 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-15 21:04 [PATCH v3 0/7] drm/i915/reset: Expose "display_reset_count" in debugfs Ville Syrjala
2026-04-15 21:04 ` Ville Syrjala [this message]
2026-04-16 8:17 ` [PATCH v3 1/7] drm/i915: Clear i915->display when no longer valid Jani Nikula
2026-04-15 21:04 ` [PATCH v3 2/7] drm/xe: Clear xe->display " Ville Syrjala
2026-04-16 15:49 ` Jani Nikula
2026-04-15 21:04 ` [PATCH v3 3/7] drm/i915/reset: Reorganize display reset code Ville Syrjala
2026-04-15 21:04 ` [PATCH v3 4/7] drm/i915/reset: Move pending_fb_pin handling to i915 Ville Syrjala
2026-04-15 21:04 ` [PATCH v3 5/7] drm/xe/display: Add init_clock_gating.h stubs Ville Syrjala
2026-04-15 21:04 ` [PATCH v3 6/7] drm/i915/reset: Add "display_reset_count" debugfs file Ville Syrjala
2026-04-15 21:04 ` [PATCH v3 7/7] drm/i915/reset: Disable execlist per-engine reset for display reset tests Ville Syrjala
2026-04-15 21:11 ` ✓ CI.KUnit: success for drm/i915/reset: Expose "display_reset_count" in debugfs (rev4) Patchwork
2026-04-15 22:07 ` ✓ Xe.CI.BAT: " Patchwork
2026-04-15 23:44 ` ✓ Xe.CI.FULL: " Patchwork
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260415210411.24750-2-ville.syrjala@linux.intel.com \
--to=ville.syrjala@linux.intel.com \
--cc=intel-gfx@lists.freedesktop.org \
--cc=intel-xe@lists.freedesktop.org \
--cc=jani.nikula@intel.com \
--cc=jouni.hogander@intel.com \
--cc=maarten.lankhorst@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox