* Re: [PATCH] drm/msm: Fix GEM free for imported dma-bufs
2025-09-23 14:04 ` [PATCH] drm/msm: Fix GEM free for imported dma-bufs Rob Clark
@ 2025-09-23 19:35 ` Stephan Gerhold
2025-10-01 7:37 ` Luca Weiss
2025-10-06 11:12 ` Bryan O'Donoghue
2 siblings, 0 replies; 4+ messages in thread
From: Stephan Gerhold @ 2025-09-23 19:35 UTC (permalink / raw)
To: Rob Clark
Cc: dri-devel, freedreno, linux-arm-msm, Dmitry Baryshkov,
Abhinav Kumar, Jessica Zhang, Sean Paul, Marijn Suijten,
David Airlie, Simona Vetter, open list
On Tue, Sep 23, 2025 at 07:04:40AM -0700, Rob Clark wrote:
> Imported dma-bufs also have obj->resv != &obj->_resv. So we should
> check both this condition in addition to flags for handling the
> _NO_SHARE case.
>
> Fixes this splat that was reported with IRIS video playback:
>
> ------------[ cut here ]------------
> WARNING: CPU: 3 PID: 2040 at drivers/gpu/drm/msm/msm_gem.c:1127 msm_gem_free_object+0x1f8/0x264 [msm]
> CPU: 3 UID: 1000 PID: 2040 Comm: .gnome-shell-wr Not tainted 6.17.0-rc7 #1 PREEMPT
> pstate: 81400005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
> pc : msm_gem_free_object+0x1f8/0x264 [msm]
> lr : msm_gem_free_object+0x138/0x264 [msm]
> sp : ffff800092a1bb30
> x29: ffff800092a1bb80 x28: ffff800092a1bce8 x27: ffffbc702dbdbe08
> x26: 0000000000000008 x25: 0000000000000009 x24: 00000000000000a6
> x23: ffff00083c72f850 x22: ffff00083c72f868 x21: ffff00087e69f200
> x20: ffff00087e69f330 x19: ffff00084d157ae0 x18: 0000000000000000
> x17: 0000000000000000 x16: ffffbc704bd46b80 x15: 0000ffffd0959540
> x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
> x11: ffffbc702e6cdb48 x10: 0000000000000000 x9 : 000000000000003f
> x8 : ffff800092a1ba90 x7 : 0000000000000000 x6 : 0000000000000020
> x5 : ffffbc704bd46c40 x4 : fffffdffe102cf60 x3 : 0000000000400032
> x2 : 0000000000020000 x1 : ffff00087e6978e8 x0 : ffff00087e6977e8
> Call trace:
> msm_gem_free_object+0x1f8/0x264 [msm] (P)
> drm_gem_object_free+0x1c/0x30 [drm]
> drm_gem_object_handle_put_unlocked+0x138/0x150 [drm]
> drm_gem_object_release_handle+0x5c/0xcc [drm]
> drm_gem_handle_delete+0x68/0xbc [drm]
> drm_gem_close_ioctl+0x34/0x40 [drm]
> drm_ioctl_kernel+0xc0/0x130 [drm]
> drm_ioctl+0x360/0x4e0 [drm]
> __arm64_sys_ioctl+0xac/0x104
> invoke_syscall+0x48/0x104
> el0_svc_common.constprop.0+0x40/0xe0
> do_el0_svc+0x1c/0x28
> el0_svc+0x34/0xec
> el0t_64_sync_handler+0xa0/0xe4
> el0t_64_sync+0x198/0x19c
> ---[ end trace 0000000000000000 ]---
> ------------[ cut here ]------------
>
> Reported-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Tested-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Perhaps also add
Closes: https://lore.kernel.org/r/aNF6N8u1VIFSTaRM@linaro.org/
when applying.
Thanks!
Stephan
> Fixes: de651b6e040b ("drm/msm: Fix refcnt underflow in error path")
> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
> ---
> drivers/gpu/drm/msm/msm_gem.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
> index 9f0f5b77f1bd..3aea9b493375 100644
> --- a/drivers/gpu/drm/msm/msm_gem.c
> +++ b/drivers/gpu/drm/msm/msm_gem.c
> @@ -1121,12 +1121,16 @@ static void msm_gem_free_object(struct drm_gem_object *obj)
> put_pages(obj);
> }
>
> - if (obj->resv != &obj->_resv) {
> + /*
> + * In error paths, we could end up here before msm_gem_new_handle()
> + * has changed obj->resv to point to the shared resv. In this case,
> + * we don't want to drop a ref to the shared r_obj that we haven't
> + * taken yet.
> + */
> + if ((msm_obj->flags & MSM_BO_NO_SHARE) && (obj->resv != &obj->_resv)) {
> struct drm_gem_object *r_obj =
> container_of(obj->resv, struct drm_gem_object, _resv);
>
> - WARN_ON(!(msm_obj->flags & MSM_BO_NO_SHARE));
> -
> /* Drop reference we hold to shared resv obj: */
> drm_gem_object_put(r_obj);
> }
> --
> 2.51.0
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] drm/msm: Fix GEM free for imported dma-bufs
2025-09-23 14:04 ` [PATCH] drm/msm: Fix GEM free for imported dma-bufs Rob Clark
2025-09-23 19:35 ` Stephan Gerhold
@ 2025-10-01 7:37 ` Luca Weiss
2025-10-06 11:12 ` Bryan O'Donoghue
2 siblings, 0 replies; 4+ messages in thread
From: Luca Weiss @ 2025-10-01 7:37 UTC (permalink / raw)
To: Rob Clark, dri-devel
Cc: freedreno, linux-arm-msm, Stephan Gerhold, Dmitry Baryshkov,
Abhinav Kumar, Jessica Zhang, Sean Paul, Marijn Suijten,
David Airlie, Simona Vetter, open list
On Tue Sep 23, 2025 at 4:04 PM CEST, Rob Clark wrote:
> Imported dma-bufs also have obj->resv != &obj->_resv. So we should
> check both this condition in addition to flags for handling the
> _NO_SHARE case.
>
> Fixes this splat that was reported with IRIS video playback:
>
> ------------[ cut here ]------------
> WARNING: CPU: 3 PID: 2040 at drivers/gpu/drm/msm/msm_gem.c:1127 msm_gem_free_object+0x1f8/0x264 [msm]
> CPU: 3 UID: 1000 PID: 2040 Comm: .gnome-shell-wr Not tainted 6.17.0-rc7 #1 PREEMPT
> pstate: 81400005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
> pc : msm_gem_free_object+0x1f8/0x264 [msm]
> lr : msm_gem_free_object+0x138/0x264 [msm]
> sp : ffff800092a1bb30
> x29: ffff800092a1bb80 x28: ffff800092a1bce8 x27: ffffbc702dbdbe08
> x26: 0000000000000008 x25: 0000000000000009 x24: 00000000000000a6
> x23: ffff00083c72f850 x22: ffff00083c72f868 x21: ffff00087e69f200
> x20: ffff00087e69f330 x19: ffff00084d157ae0 x18: 0000000000000000
> x17: 0000000000000000 x16: ffffbc704bd46b80 x15: 0000ffffd0959540
> x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
> x11: ffffbc702e6cdb48 x10: 0000000000000000 x9 : 000000000000003f
> x8 : ffff800092a1ba90 x7 : 0000000000000000 x6 : 0000000000000020
> x5 : ffffbc704bd46c40 x4 : fffffdffe102cf60 x3 : 0000000000400032
> x2 : 0000000000020000 x1 : ffff00087e6978e8 x0 : ffff00087e6977e8
> Call trace:
> msm_gem_free_object+0x1f8/0x264 [msm] (P)
> drm_gem_object_free+0x1c/0x30 [drm]
> drm_gem_object_handle_put_unlocked+0x138/0x150 [drm]
> drm_gem_object_release_handle+0x5c/0xcc [drm]
> drm_gem_handle_delete+0x68/0xbc [drm]
> drm_gem_close_ioctl+0x34/0x40 [drm]
> drm_ioctl_kernel+0xc0/0x130 [drm]
> drm_ioctl+0x360/0x4e0 [drm]
> __arm64_sys_ioctl+0xac/0x104
> invoke_syscall+0x48/0x104
> el0_svc_common.constprop.0+0x40/0xe0
> do_el0_svc+0x1c/0x28
> el0_svc+0x34/0xec
> el0t_64_sync_handler+0xa0/0xe4
> el0t_64_sync+0x198/0x19c
> ---[ end trace 0000000000000000 ]---
> ------------[ cut here ]------------
Also fixes log spam when opening GNOME Camera on Fairphone 5.
Tested-by: Luca Weiss <luca.weiss@fairphone.com>
Regards
Luca
>
> Reported-by: Stephan Gerhold <stephan.gerhold@linaro.org>
> Fixes: de651b6e040b ("drm/msm: Fix refcnt underflow in error path")
> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
> ---
> drivers/gpu/drm/msm/msm_gem.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
> index 9f0f5b77f1bd..3aea9b493375 100644
> --- a/drivers/gpu/drm/msm/msm_gem.c
> +++ b/drivers/gpu/drm/msm/msm_gem.c
> @@ -1121,12 +1121,16 @@ static void msm_gem_free_object(struct drm_gem_object *obj)
> put_pages(obj);
> }
>
> - if (obj->resv != &obj->_resv) {
> + /*
> + * In error paths, we could end up here before msm_gem_new_handle()
> + * has changed obj->resv to point to the shared resv. In this case,
> + * we don't want to drop a ref to the shared r_obj that we haven't
> + * taken yet.
> + */
> + if ((msm_obj->flags & MSM_BO_NO_SHARE) && (obj->resv != &obj->_resv)) {
> struct drm_gem_object *r_obj =
> container_of(obj->resv, struct drm_gem_object, _resv);
>
> - WARN_ON(!(msm_obj->flags & MSM_BO_NO_SHARE));
> -
> /* Drop reference we hold to shared resv obj: */
> drm_gem_object_put(r_obj);
> }
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] drm/msm: Fix GEM free for imported dma-bufs
2025-09-23 14:04 ` [PATCH] drm/msm: Fix GEM free for imported dma-bufs Rob Clark
2025-09-23 19:35 ` Stephan Gerhold
2025-10-01 7:37 ` Luca Weiss
@ 2025-10-06 11:12 ` Bryan O'Donoghue
2 siblings, 0 replies; 4+ messages in thread
From: Bryan O'Donoghue @ 2025-10-06 11:12 UTC (permalink / raw)
To: Rob Clark, dri-devel
Cc: freedreno, linux-arm-msm, Stephan Gerhold, Dmitry Baryshkov,
Abhinav Kumar, Jessica Zhang, Sean Paul, Marijn Suijten,
David Airlie, Simona Vetter, linux-kernel
On 23/09/2025 15:04, Rob Clark wrote:
> Imported dma-bufs also have obj->resv != &obj->_resv. So we should
> check both this condition in addition to flags for handling the
> _NO_SHARE case.
>
> Fixes this splat that was reported with IRIS video playback:
>
> ------------[ cut here ]------------
> WARNING: CPU: 3 PID: 2040 at drivers/gpu/drm/msm/msm_gem.c:1127 msm_gem_free_object+0x1f8/0x264 [msm]
> CPU: 3 UID: 1000 PID: 2040 Comm: .gnome-shell-wr Not tainted 6.17.0-rc7 #1 PREEMPT
> pstate: 81400005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
> pc : msm_gem_free_object+0x1f8/0x264 [msm]
> lr : msm_gem_free_object+0x138/0x264 [msm]
> sp : ffff800092a1bb30
> x29: ffff800092a1bb80 x28: ffff800092a1bce8 x27: ffffbc702dbdbe08
> x26: 0000000000000008 x25: 0000000000000009 x24: 00000000000000a6
> x23: ffff00083c72f850 x22: ffff00083c72f868 x21: ffff00087e69f200
> x20: ffff00087e69f330 x19: ffff00084d157ae0 x18: 0000000000000000
> x17: 0000000000000000 x16: ffffbc704bd46b80 x15: 0000ffffd0959540
> x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
> x11: ffffbc702e6cdb48 x10: 0000000000000000 x9 : 000000000000003f
> x8 : ffff800092a1ba90 x7 : 0000000000000000 x6 : 0000000000000020
> x5 : ffffbc704bd46c40 x4 : fffffdffe102cf60 x3 : 0000000000400032
> x2 : 0000000000020000 x1 : ffff00087e6978e8 x0 : ffff00087e6977e8
> Call trace:
> msm_gem_free_object+0x1f8/0x264 [msm] (P)
> drm_gem_object_free+0x1c/0x30 [drm]
> drm_gem_object_handle_put_unlocked+0x138/0x150 [drm]
> drm_gem_object_release_handle+0x5c/0xcc [drm]
> drm_gem_handle_delete+0x68/0xbc [drm]
> drm_gem_close_ioctl+0x34/0x40 [drm]
> drm_ioctl_kernel+0xc0/0x130 [drm]
> drm_ioctl+0x360/0x4e0 [drm]
> __arm64_sys_ioctl+0xac/0x104
> invoke_syscall+0x48/0x104
> el0_svc_common.constprop.0+0x40/0xe0
> do_el0_svc+0x1c/0x28
> el0_svc+0x34/0xec
> el0t_64_sync_handler+0xa0/0xe4
> el0t_64_sync+0x198/0x19c
> ---[ end trace 0000000000000000 ]---
> ------------[ cut here ]------------
>
> Reported-by: Stephan Gerhold <stephan.gerhold@linaro.org>
> Fixes: de651b6e040b ("drm/msm: Fix refcnt underflow in error path")
> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
> ---
> drivers/gpu/drm/msm/msm_gem.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
> index 9f0f5b77f1bd..3aea9b493375 100644
> --- a/drivers/gpu/drm/msm/msm_gem.c
> +++ b/drivers/gpu/drm/msm/msm_gem.c
> @@ -1121,12 +1121,16 @@ static void msm_gem_free_object(struct drm_gem_object *obj)
> put_pages(obj);
> }
>
> - if (obj->resv != &obj->_resv) {
> + /*
> + * In error paths, we could end up here before msm_gem_new_handle()
> + * has changed obj->resv to point to the shared resv. In this case,
> + * we don't want to drop a ref to the shared r_obj that we haven't
> + * taken yet.
> + */
> + if ((msm_obj->flags & MSM_BO_NO_SHARE) && (obj->resv != &obj->_resv)) {
> struct drm_gem_object *r_obj =
> container_of(obj->resv, struct drm_gem_object, _resv);
>
> - WARN_ON(!(msm_obj->flags & MSM_BO_NO_SHARE));
> -
> /* Drop reference we hold to shared resv obj: */
> drm_gem_object_put(r_obj);
> }
> --
> 2.51.0
>
>
Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # qrb5165-rb5
^ permalink raw reply [flat|nested] 4+ messages in thread