Re: [PATCH 2/2] RFC: drm/xe: Prevent pinned_link double add

[Matthew Brost <matthew.brost@intel.com>]

On Tue, Oct 06, 2026 at 10:57:41AM -0700, FNU VISHWANATHA wrote:
> From: Kornel Dulęba <korneld@google.com>
> 
> When running CtsCameraTestCases on a memory constrained, 4GB device the
> following list corruption oops was consistently observed:
> 
> list_del corruption. prev->next should be ffff9ebe1ce42ea8, but was ffff9ebdf741fea8. (prev=ffff9ebe1ce43aa8)
> 
> After adding printfs in multiple places it was concluded that
> bo->pinned_link was already a part of a list when xe_bo_pin_external
> tried adding it to xe->pinned.late.external.
> To fix this add a list_empty check and a WARN_ONCE in case the list is
> in fact not empty.
> With this addition the CtsCameraTestCases can now complete with no
> kernel crashes.
> 
> Test: atest CtsCameraTestCases
> Signed-off-by: Kornel Dulęba <korneld@google.com>
> ---
>  drivers/gpu/drm/xe/xe_bo.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> index c5989db950f7..cc5a4ff64791 100644
> --- a/drivers/gpu/drm/xe/xe_bo.c
> +++ b/drivers/gpu/drm/xe/xe_bo.c
> @@ -2762,7 +2762,14 @@ int xe_bo_pin_external(struct xe_bo *bo, bool in_place, struct drm_exec *exec)
>  		}
>  
>  		spin_lock(&xe->pinned.lock);
> -		list_add_tail(&bo->pinned_link, &xe->pinned.late.external);

Like in first patch - I'd rather have a 'xe_assert(xe,
list_empty(&bo->pinned_link)' here as any other state is a bug.

Again if it pops, we then case down why this occuring rather than
papering over.

Again file gitlab with details so we can assist.

Matt

> +		if (list_empty(&bo->pinned_link)) {
> +			list_add_tail(&bo->pinned_link,
> +				      &xe->pinned.late.external);
> +		} else {
> +			WARN_ONCE(true,
> +				  "pinned_link already added to a list, bo->ttm.pin_count: %d\n",
> +				  bo->ttm.pin_count);
> +		}
>  		spin_unlock(&xe->pinned.lock);
>  	}
>  
> -- 
> 2.34.1
>