* [PATCH v7 1/6] drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
[not found] <20260703130541.2686-1-thomas.hellstrom@linux.intel.com>
@ 2026-07-03 13:05 ` Thomas Hellström
2026-07-03 13:08 ` Christian König
0 siblings, 1 reply; 10+ messages in thread
From: Thomas Hellström @ 2026-07-03 13:05 UTC (permalink / raw)
To: intel-xe
Cc: Thomas Hellström, Sashiko-bot, Friedrich Vock,
Maarten Lankhorst, Tejun Heo, Maxime Ripard, Christian König,
Alex Deucher, amd-gfx, dri-devel, stable, Natalie Vock,
Johannes Weiner, Michal Koutný, cgroups, Huang Rui,
Matthew Brost, Matthew Auld, Maarten Lankhorst, Thomas Zimmermann,
Simona Vetter, David Airlie, Thadeu Lima de Souza Cascardo,
Rodrigo Vivi, linux-kernel
drmm_cgroup_register_region() is called before INIT_LIST_HEAD() and
gpu_buddy_init() in amdgpu_vram_mgr_init(). If it fails, the function
returns early and bypasses those initializations.
Since adev->mman.initialized is set to true before amdgpu_vram_mgr_init()
is called, a failure triggers amdgpu_ttm_fini(), which calls
amdgpu_vram_mgr_fini(), which then:
- Calls list_for_each_entry_safe() on reservations_pending and
reserved_pages, whose list_head::next pointers are zero-initialized
(NULL). The loop does not recognize them as empty and dereferences NULL.
- Calls gpu_buddy_fini(), which iterates free_trees[] unconditionally
via for_each_free_tree(). Since mm->free_trees is NULL
(never allocated), this dereferences NULL.
Both result in a kernel panic on the module load error path.
Fix by moving drmm_cgroup_register_region() to after the list and buddy
allocator are fully initialized, so the teardown path is safe to run.
Reported-by: Sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260428073116.15687-1-thomas.hellstrom@linux.intel.com?part=4
Fixes: 2b624a2c1865 ("drm/ttm: Handle cgroup based eviction in TTM")
Cc: Friedrich Vock <friedrich.vock@gmx.de>
Cc: Maarten Lankhorst <dev@lankhorst.se>
Cc: Tejun Heo <tj@kernel.org>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Christian König <christian.koenig@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.14+
Assisted-by: GitHub_Copilot:claude-sonnet-4.6
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
index 2a241a5b12c4..ac3f71d77140 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
@@ -918,9 +918,6 @@ int amdgpu_vram_mgr_init(struct amdgpu_device *adev)
struct ttm_resource_manager *man = &mgr->manager;
int err;
- man->cg = drmm_cgroup_register_region(adev_to_drm(adev), "vram", adev->gmc.real_vram_size);
- if (IS_ERR(man->cg))
- return PTR_ERR(man->cg);
ttm_resource_manager_init(man, &adev->mman.bdev,
adev->gmc.real_vram_size);
@@ -935,6 +932,10 @@ int amdgpu_vram_mgr_init(struct amdgpu_device *adev)
if (err)
return err;
+ man->cg = drmm_cgroup_register_region(adev_to_drm(adev), "vram", adev->gmc.real_vram_size);
+ if (IS_ERR(man->cg))
+ return PTR_ERR(man->cg);
+
ttm_set_driver_manager(&adev->mman.bdev, TTM_PL_VRAM, &mgr->manager);
ttm_resource_manager_set_used(man, true);
return 0;
--
2.54.0
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [PATCH v7 1/6] drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
2026-07-03 13:05 ` [PATCH v7 1/6] drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init() Thomas Hellström
@ 2026-07-03 13:08 ` Christian König
2026-07-03 13:11 ` Thomas Hellström
2026-07-07 18:05 ` Arunpravin Paneer Selvam
0 siblings, 2 replies; 10+ messages in thread
From: Christian König @ 2026-07-03 13:08 UTC (permalink / raw)
To: Thomas Hellström, intel-xe, Paneer Selvam, Arunpravin
Cc: Sashiko-bot, Friedrich Vock, Maarten Lankhorst, Tejun Heo,
Maxime Ripard, Alex Deucher, amd-gfx, dri-devel, stable,
Natalie Vock, Johannes Weiner, Michal Koutný, cgroups,
Huang Rui, Matthew Brost, Matthew Auld, Maarten Lankhorst,
Thomas Zimmermann, Simona Vetter, David Airlie,
Thadeu Lima de Souza Cascardo, Rodrigo Vivi, linux-kernel
Arun please take a look at this.
Thanks,
Christian.
On 7/3/26 15:05, Thomas Hellström wrote:
> drmm_cgroup_register_region() is called before INIT_LIST_HEAD() and
> gpu_buddy_init() in amdgpu_vram_mgr_init(). If it fails, the function
> returns early and bypasses those initializations.
>
> Since adev->mman.initialized is set to true before amdgpu_vram_mgr_init()
> is called, a failure triggers amdgpu_ttm_fini(), which calls
> amdgpu_vram_mgr_fini(), which then:
>
> - Calls list_for_each_entry_safe() on reservations_pending and
> reserved_pages, whose list_head::next pointers are zero-initialized
> (NULL). The loop does not recognize them as empty and dereferences NULL.
>
> - Calls gpu_buddy_fini(), which iterates free_trees[] unconditionally
> via for_each_free_tree(). Since mm->free_trees is NULL
> (never allocated), this dereferences NULL.
>
> Both result in a kernel panic on the module load error path.
>
> Fix by moving drmm_cgroup_register_region() to after the list and buddy
> allocator are fully initialized, so the teardown path is safe to run.
>
> Reported-by: Sashiko-bot <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260428073116.15687-1-thomas.hellstrom@linux.intel.com?part=4
> Fixes: 2b624a2c1865 ("drm/ttm: Handle cgroup based eviction in TTM")
> Cc: Friedrich Vock <friedrich.vock@gmx.de>
> Cc: Maarten Lankhorst <dev@lankhorst.se>
> Cc: Tejun Heo <tj@kernel.org>
> Cc: Maxime Ripard <mripard@kernel.org>
> Cc: Christian König <christian.koenig@amd.com>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: amd-gfx@lists.freedesktop.org
> Cc: dri-devel@lists.freedesktop.org
> Cc: <stable@vger.kernel.org> # v6.14+
> Assisted-by: GitHub_Copilot:claude-sonnet-4.6
> Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
> index 2a241a5b12c4..ac3f71d77140 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
> @@ -918,9 +918,6 @@ int amdgpu_vram_mgr_init(struct amdgpu_device *adev)
> struct ttm_resource_manager *man = &mgr->manager;
> int err;
>
> - man->cg = drmm_cgroup_register_region(adev_to_drm(adev), "vram", adev->gmc.real_vram_size);
> - if (IS_ERR(man->cg))
> - return PTR_ERR(man->cg);
> ttm_resource_manager_init(man, &adev->mman.bdev,
> adev->gmc.real_vram_size);
>
> @@ -935,6 +932,10 @@ int amdgpu_vram_mgr_init(struct amdgpu_device *adev)
> if (err)
> return err;
>
> + man->cg = drmm_cgroup_register_region(adev_to_drm(adev), "vram", adev->gmc.real_vram_size);
> + if (IS_ERR(man->cg))
> + return PTR_ERR(man->cg);
> +
> ttm_set_driver_manager(&adev->mman.bdev, TTM_PL_VRAM, &mgr->manager);
> ttm_resource_manager_set_used(man, true);
> return 0;
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v7 1/6] drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
2026-07-03 13:08 ` Christian König
@ 2026-07-03 13:11 ` Thomas Hellström
2026-07-22 9:58 ` Arunpravin Paneer Selvam
2026-07-07 18:05 ` Arunpravin Paneer Selvam
1 sibling, 1 reply; 10+ messages in thread
From: Thomas Hellström @ 2026-07-03 13:11 UTC (permalink / raw)
To: Christian König, intel-xe, Paneer Selvam, Arunpravin
Cc: Sashiko-bot, Friedrich Vock, Maarten Lankhorst, Tejun Heo,
Maxime Ripard, Alex Deucher, amd-gfx, dri-devel, stable,
Natalie Vock, Johannes Weiner, Michal Koutný, cgroups,
Huang Rui, Matthew Brost, Matthew Auld, Maarten Lankhorst,
Thomas Zimmermann, Simona Vetter, David Airlie,
Thadeu Lima de Souza Cascardo, Rodrigo Vivi, linux-kernel
On Fri, 2026-07-03 at 15:08 +0200, Christian König wrote:
> Arun please take a look at this.
>
> Thanks,
> Christian.
FWIW Sashiko claims there is yet another pre-existing bug WRT ordering
here, but since the fix wasn't needed for the rest of the series, I
focused on this one.
Thanks,
Thomas
>
> On 7/3/26 15:05, Thomas Hellström wrote:
> > drmm_cgroup_register_region() is called before INIT_LIST_HEAD() and
> > gpu_buddy_init() in amdgpu_vram_mgr_init(). If it fails, the
> > function
> > returns early and bypasses those initializations.
> >
> > Since adev->mman.initialized is set to true before
> > amdgpu_vram_mgr_init()
> > is called, a failure triggers amdgpu_ttm_fini(), which calls
> > amdgpu_vram_mgr_fini(), which then:
> >
> > - Calls list_for_each_entry_safe() on reservations_pending and
> > reserved_pages, whose list_head::next pointers are zero-
> > initialized
> > (NULL). The loop does not recognize them as empty and
> > dereferences NULL.
> >
> > - Calls gpu_buddy_fini(), which iterates free_trees[]
> > unconditionally
> > via for_each_free_tree(). Since mm->free_trees is NULL
> > (never allocated), this dereferences NULL.
> >
> > Both result in a kernel panic on the module load error path.
> >
> > Fix by moving drmm_cgroup_register_region() to after the list and
> > buddy
> > allocator are fully initialized, so the teardown path is safe to
> > run.
> >
> > Reported-by: Sashiko-bot <sashiko-bot@kernel.org>
> > Closes:
> > https://sashiko.dev/#/patchset/20260428073116.15687-1-thomas.hellstrom@linux.intel.com?part=4
> > Fixes: 2b624a2c1865 ("drm/ttm: Handle cgroup based eviction in
> > TTM")
> > Cc: Friedrich Vock <friedrich.vock@gmx.de>
> > Cc: Maarten Lankhorst <dev@lankhorst.se>
> > Cc: Tejun Heo <tj@kernel.org>
> > Cc: Maxime Ripard <mripard@kernel.org>
> > Cc: Christian König <christian.koenig@amd.com>
> > Cc: Alex Deucher <alexander.deucher@amd.com>
> > Cc: amd-gfx@lists.freedesktop.org
> > Cc: dri-devel@lists.freedesktop.org
> > Cc: <stable@vger.kernel.org> # v6.14+
> > Assisted-by: GitHub_Copilot:claude-sonnet-4.6
> > Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> > ---
> > drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 ++++---
> > 1 file changed, 4 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
> > b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
> > index 2a241a5b12c4..ac3f71d77140 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
> > @@ -918,9 +918,6 @@ int amdgpu_vram_mgr_init(struct amdgpu_device
> > *adev)
> > struct ttm_resource_manager *man = &mgr->manager;
> > int err;
> >
> > - man->cg = drmm_cgroup_register_region(adev_to_drm(adev),
> > "vram", adev->gmc.real_vram_size);
> > - if (IS_ERR(man->cg))
> > - return PTR_ERR(man->cg);
> > ttm_resource_manager_init(man, &adev->mman.bdev,
> > adev->gmc.real_vram_size);
> >
> > @@ -935,6 +932,10 @@ int amdgpu_vram_mgr_init(struct amdgpu_device
> > *adev)
> > if (err)
> > return err;
> >
> > + man->cg = drmm_cgroup_register_region(adev_to_drm(adev),
> > "vram", adev->gmc.real_vram_size);
> > + if (IS_ERR(man->cg))
> > + return PTR_ERR(man->cg);
> > +
> > ttm_set_driver_manager(&adev->mman.bdev, TTM_PL_VRAM,
> > &mgr->manager);
> > ttm_resource_manager_set_used(man, true);
> > return 0;
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v7 1/6] drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
2026-07-03 13:08 ` Christian König
2026-07-03 13:11 ` Thomas Hellström
@ 2026-07-07 18:05 ` Arunpravin Paneer Selvam
2026-07-21 11:46 ` Maarten Lankhorst
1 sibling, 1 reply; 10+ messages in thread
From: Arunpravin Paneer Selvam @ 2026-07-07 18:05 UTC (permalink / raw)
To: Christian König, Thomas Hellström, intel-xe
Cc: Sashiko-bot, Friedrich Vock, Maarten Lankhorst, Tejun Heo,
Maxime Ripard, Alex Deucher, amd-gfx, dri-devel, stable,
Natalie Vock, Johannes Weiner, Michal Koutný, cgroups,
Huang Rui, Matthew Brost, Matthew Auld, Maarten Lankhorst,
Thomas Zimmermann, Simona Vetter, David Airlie,
Thadeu Lima de Souza Cascardo, Rodrigo Vivi, linux-kernel
On 7/3/2026 6:38 PM, Christian König wrote:
> Arun please take a look at this.
Sure Christian. This fix looks correct to me.
Reviewed-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Thanks,
Arun.
>
> Thanks,
> Christian.
>
> On 7/3/26 15:05, Thomas Hellström wrote:
>> drmm_cgroup_register_region() is called before INIT_LIST_HEAD() and
>> gpu_buddy_init() in amdgpu_vram_mgr_init(). If it fails, the function
>> returns early and bypasses those initializations.
>>
>> Since adev->mman.initialized is set to true before amdgpu_vram_mgr_init()
>> is called, a failure triggers amdgpu_ttm_fini(), which calls
>> amdgpu_vram_mgr_fini(), which then:
>>
>> - Calls list_for_each_entry_safe() on reservations_pending and
>> reserved_pages, whose list_head::next pointers are zero-initialized
>> (NULL). The loop does not recognize them as empty and dereferences NULL.
>>
>> - Calls gpu_buddy_fini(), which iterates free_trees[] unconditionally
>> via for_each_free_tree(). Since mm->free_trees is NULL
>> (never allocated), this dereferences NULL.
>>
>> Both result in a kernel panic on the module load error path.
>>
>> Fix by moving drmm_cgroup_register_region() to after the list and buddy
>> allocator are fully initialized, so the teardown path is safe to run.
>>
>> Reported-by: Sashiko-bot <sashiko-bot@kernel.org>
>> Closes: https://sashiko.dev/#/patchset/20260428073116.15687-1-thomas.hellstrom@linux.intel.com?part=4
>> Fixes: 2b624a2c1865 ("drm/ttm: Handle cgroup based eviction in TTM")
>> Cc: Friedrich Vock <friedrich.vock@gmx.de>
>> Cc: Maarten Lankhorst <dev@lankhorst.se>
>> Cc: Tejun Heo <tj@kernel.org>
>> Cc: Maxime Ripard <mripard@kernel.org>
>> Cc: Christian König <christian.koenig@amd.com>
>> Cc: Alex Deucher <alexander.deucher@amd.com>
>> Cc: amd-gfx@lists.freedesktop.org
>> Cc: dri-devel@lists.freedesktop.org
>> Cc: <stable@vger.kernel.org> # v6.14+
>> Assisted-by: GitHub_Copilot:claude-sonnet-4.6
>> Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>> ---
>> drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 ++++---
>> 1 file changed, 4 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>> index 2a241a5b12c4..ac3f71d77140 100644
>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>> @@ -918,9 +918,6 @@ int amdgpu_vram_mgr_init(struct amdgpu_device *adev)
>> struct ttm_resource_manager *man = &mgr->manager;
>> int err;
>>
>> - man->cg = drmm_cgroup_register_region(adev_to_drm(adev), "vram", adev->gmc.real_vram_size);
>> - if (IS_ERR(man->cg))
>> - return PTR_ERR(man->cg);
>> ttm_resource_manager_init(man, &adev->mman.bdev,
>> adev->gmc.real_vram_size);
>>
>> @@ -935,6 +932,10 @@ int amdgpu_vram_mgr_init(struct amdgpu_device *adev)
>> if (err)
>> return err;
>>
>> + man->cg = drmm_cgroup_register_region(adev_to_drm(adev), "vram", adev->gmc.real_vram_size);
>> + if (IS_ERR(man->cg))
>> + return PTR_ERR(man->cg);
>> +
>> ttm_set_driver_manager(&adev->mman.bdev, TTM_PL_VRAM, &mgr->manager);
>> ttm_resource_manager_set_used(man, true);
>> return 0;
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v7 1/6] drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
2026-07-07 18:05 ` Arunpravin Paneer Selvam
@ 2026-07-21 11:46 ` Maarten Lankhorst
2026-07-21 12:10 ` Thomas Hellström
2026-08-03 12:30 ` Christian König
0 siblings, 2 replies; 10+ messages in thread
From: Maarten Lankhorst @ 2026-07-21 11:46 UTC (permalink / raw)
To: Arunpravin Paneer Selvam, Christian König,
Thomas Hellström, intel-xe
Cc: Sashiko-bot, Friedrich Vock, Maarten Lankhorst, Tejun Heo,
Maxime Ripard, Alex Deucher, amd-gfx, dri-devel, stable,
Natalie Vock, Johannes Weiner, Michal Koutný, cgroups,
Huang Rui, Matthew Brost, Matthew Auld, Thomas Zimmermann,
Simona Vetter, David Airlie, Thadeu Lima de Souza Cascardo,
Rodrigo Vivi, linux-kernel
Hey,
Can I merge this through drm-misc-next together with the rest of the series?
Kind regards
~Maarten
On 7/7/26 20:05, Arunpravin Paneer Selvam wrote:
>
>
> On 7/3/2026 6:38 PM, Christian König wrote:
>> Arun please take a look at this.
> Sure Christian. This fix looks correct to me.
> Reviewed-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
>
> Thanks,
> Arun.
>>
>> Thanks,
>> Christian.
>>
>> On 7/3/26 15:05, Thomas Hellström wrote:
>>> drmm_cgroup_register_region() is called before INIT_LIST_HEAD() and
>>> gpu_buddy_init() in amdgpu_vram_mgr_init(). If it fails, the function
>>> returns early and bypasses those initializations.
>>>
>>> Since adev->mman.initialized is set to true before amdgpu_vram_mgr_init()
>>> is called, a failure triggers amdgpu_ttm_fini(), which calls
>>> amdgpu_vram_mgr_fini(), which then:
>>>
>>> - Calls list_for_each_entry_safe() on reservations_pending and
>>> reserved_pages, whose list_head::next pointers are zero-initialized
>>> (NULL). The loop does not recognize them as empty and dereferences NULL.
>>>
>>> - Calls gpu_buddy_fini(), which iterates free_trees[] unconditionally
>>> via for_each_free_tree(). Since mm->free_trees is NULL
>>> (never allocated), this dereferences NULL.
>>>
>>> Both result in a kernel panic on the module load error path.
>>>
>>> Fix by moving drmm_cgroup_register_region() to after the list and buddy
>>> allocator are fully initialized, so the teardown path is safe to run.
>>>
>>> Reported-by: Sashiko-bot <sashiko-bot@kernel.org>
>>> Closes: https://sashiko.dev/#/patchset/20260428073116.15687-1-thomas.hellstrom@linux.intel.com?part=4
>>> Fixes: 2b624a2c1865 ("drm/ttm: Handle cgroup based eviction in TTM")
>>> Cc: Friedrich Vock <friedrich.vock@gmx.de>
>>> Cc: Maarten Lankhorst <dev@lankhorst.se>
>>> Cc: Tejun Heo <tj@kernel.org>
>>> Cc: Maxime Ripard <mripard@kernel.org>
>>> Cc: Christian König <christian.koenig@amd.com>
>>> Cc: Alex Deucher <alexander.deucher@amd.com>
>>> Cc: amd-gfx@lists.freedesktop.org
>>> Cc: dri-devel@lists.freedesktop.org
>>> Cc: <stable@vger.kernel.org> # v6.14+
>>> Assisted-by: GitHub_Copilot:claude-sonnet-4.6
>>> Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>>> ---
>>> drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 ++++---
>>> 1 file changed, 4 insertions(+), 3 deletions(-)
>>>
>>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>> index 2a241a5b12c4..ac3f71d77140 100644
>>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>> @@ -918,9 +918,6 @@ int amdgpu_vram_mgr_init(struct amdgpu_device *adev)
>>> struct ttm_resource_manager *man = &mgr->manager;
>>> int err;
>>> - man->cg = drmm_cgroup_register_region(adev_to_drm(adev), "vram", adev->gmc.real_vram_size);
>>> - if (IS_ERR(man->cg))
>>> - return PTR_ERR(man->cg);
>>> ttm_resource_manager_init(man, &adev->mman.bdev,
>>> adev->gmc.real_vram_size);
>>> @@ -935,6 +932,10 @@ int amdgpu_vram_mgr_init(struct amdgpu_device *adev)
>>> if (err)
>>> return err;
>>> + man->cg = drmm_cgroup_register_region(adev_to_drm(adev), "vram", adev->gmc.real_vram_size);
>>> + if (IS_ERR(man->cg))
>>> + return PTR_ERR(man->cg);
>>> +
>>> ttm_set_driver_manager(&adev->mman.bdev, TTM_PL_VRAM, &mgr->manager);
>>> ttm_resource_manager_set_used(man, true);
>>> return 0;
>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v7 1/6] drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
2026-07-21 11:46 ` Maarten Lankhorst
@ 2026-07-21 12:10 ` Thomas Hellström
2026-07-21 12:26 ` Maarten Lankhorst
2026-08-03 12:30 ` Christian König
1 sibling, 1 reply; 10+ messages in thread
From: Thomas Hellström @ 2026-07-21 12:10 UTC (permalink / raw)
To: Maarten Lankhorst, Arunpravin Paneer Selvam, Christian König,
intel-xe
Cc: Sashiko-bot, Friedrich Vock, Maarten Lankhorst, Tejun Heo,
Maxime Ripard, Alex Deucher, amd-gfx, dri-devel, stable,
Natalie Vock, Johannes Weiner, Michal Koutný, cgroups,
Huang Rui, Matthew Brost, Matthew Auld, Thomas Zimmermann,
Simona Vetter, David Airlie, Thadeu Lima de Souza Cascardo,
Rodrigo Vivi, linux-kernel
Hi, Maarten,
On Tue, 2026-07-21 at 13:46 +0200, Maarten Lankhorst wrote:
> Hey,
>
> Can I merge this through drm-misc-next together with the rest of the
> series?
>
> Kind regards
> ~Maarten
For the xe patches, Ack from me.
I do have a v8 that fixes a sashiko comment on the last patch, though,
but I was holding that awaiting a review on the other patches.
Thanks,
Thomas
>
> On 7/7/26 20:05, Arunpravin Paneer Selvam wrote:
> >
> >
> > On 7/3/2026 6:38 PM, Christian König wrote:
> > > Arun please take a look at this.
> > Sure Christian. This fix looks correct to me.
> > Reviewed-by: Arunpravin Paneer Selvam
> > <Arunpravin.PaneerSelvam@amd.com>
> >
> > Thanks,
> > Arun.
> > >
> > > Thanks,
> > > Christian.
> > >
> > > On 7/3/26 15:05, Thomas Hellström wrote:
> > > > drmm_cgroup_register_region() is called before INIT_LIST_HEAD()
> > > > and
> > > > gpu_buddy_init() in amdgpu_vram_mgr_init(). If it fails, the
> > > > function
> > > > returns early and bypasses those initializations.
> > > >
> > > > Since adev->mman.initialized is set to true before
> > > > amdgpu_vram_mgr_init()
> > > > is called, a failure triggers amdgpu_ttm_fini(), which calls
> > > > amdgpu_vram_mgr_fini(), which then:
> > > >
> > > > - Calls list_for_each_entry_safe() on reservations_pending
> > > > and
> > > > reserved_pages, whose list_head::next pointers are zero-
> > > > initialized
> > > > (NULL). The loop does not recognize them as empty and
> > > > dereferences NULL.
> > > >
> > > > - Calls gpu_buddy_fini(), which iterates free_trees[]
> > > > unconditionally
> > > > via for_each_free_tree(). Since mm->free_trees is NULL
> > > > (never allocated), this dereferences NULL.
> > > >
> > > > Both result in a kernel panic on the module load error path.
> > > >
> > > > Fix by moving drmm_cgroup_register_region() to after the list
> > > > and buddy
> > > > allocator are fully initialized, so the teardown path is safe
> > > > to run.
> > > >
> > > > Reported-by: Sashiko-bot <sashiko-bot@kernel.org>
> > > > Closes:
> > > > https://sashiko.dev/#/patchset/20260428073116.15687-1-thomas.hellstrom@linux.intel.com?part=4
> > > > Fixes: 2b624a2c1865 ("drm/ttm: Handle cgroup based eviction in
> > > > TTM")
> > > > Cc: Friedrich Vock <friedrich.vock@gmx.de>
> > > > Cc: Maarten Lankhorst <dev@lankhorst.se>
> > > > Cc: Tejun Heo <tj@kernel.org>
> > > > Cc: Maxime Ripard <mripard@kernel.org>
> > > > Cc: Christian König <christian.koenig@amd.com>
> > > > Cc: Alex Deucher <alexander.deucher@amd.com>
> > > > Cc: amd-gfx@lists.freedesktop.org
> > > > Cc: dri-devel@lists.freedesktop.org
> > > > Cc: <stable@vger.kernel.org> # v6.14+
> > > > Assisted-by: GitHub_Copilot:claude-sonnet-4.6
> > > > Signed-off-by: Thomas Hellström
> > > > <thomas.hellstrom@linux.intel.com>
> > > > ---
> > > > drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 ++++---
> > > > 1 file changed, 4 insertions(+), 3 deletions(-)
> > > >
> > > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
> > > > b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
> > > > index 2a241a5b12c4..ac3f71d77140 100644
> > > > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
> > > > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
> > > > @@ -918,9 +918,6 @@ int amdgpu_vram_mgr_init(struct
> > > > amdgpu_device *adev)
> > > > struct ttm_resource_manager *man = &mgr->manager;
> > > > int err;
> > > > - man->cg = drmm_cgroup_register_region(adev_to_drm(adev),
> > > > "vram", adev->gmc.real_vram_size);
> > > > - if (IS_ERR(man->cg))
> > > > - return PTR_ERR(man->cg);
> > > > ttm_resource_manager_init(man, &adev->mman.bdev,
> > > > adev->gmc.real_vram_size);
> > > > @@ -935,6 +932,10 @@ int amdgpu_vram_mgr_init(struct
> > > > amdgpu_device *adev)
> > > > if (err)
> > > > return err;
> > > > + man->cg = drmm_cgroup_register_region(adev_to_drm(adev),
> > > > "vram", adev->gmc.real_vram_size);
> > > > + if (IS_ERR(man->cg))
> > > > + return PTR_ERR(man->cg);
> > > > +
> > > > ttm_set_driver_manager(&adev->mman.bdev, TTM_PL_VRAM,
> > > > &mgr->manager);
> > > > ttm_resource_manager_set_used(man, true);
> > > > return 0;
> >
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v7 1/6] drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
2026-07-21 12:10 ` Thomas Hellström
@ 2026-07-21 12:26 ` Maarten Lankhorst
2026-07-22 9:49 ` Arunpravin Paneer Selvam
0 siblings, 1 reply; 10+ messages in thread
From: Maarten Lankhorst @ 2026-07-21 12:26 UTC (permalink / raw)
To: Thomas Hellström, Arunpravin Paneer Selvam,
Christian König, intel-xe
Cc: Sashiko-bot, Friedrich Vock, Maarten Lankhorst, Tejun Heo,
Maxime Ripard, Alex Deucher, amd-gfx, dri-devel, stable,
Natalie Vock, Johannes Weiner, Michal Koutný, cgroups,
Huang Rui, Matthew Brost, Matthew Auld, Thomas Zimmermann,
Simona Vetter, David Airlie, Thadeu Lima de Souza Cascardo,
Rodrigo Vivi, linux-kernel
Hey,
On 7/21/26 14:10, Thomas Hellström wrote:
> Hi, Maarten,
>
> On Tue, 2026-07-21 at 13:46 +0200, Maarten Lankhorst wrote:
>> Hey,
>>
>> Can I merge this through drm-misc-next together with the rest of the
>> series?
>>
>> Kind regards
>> ~Maarten
>
> For the xe patches, Ack from me.
>
> I do have a v8 that fixes a sashiko comment on the last patch, though,
> but I was holding that awaiting a review on the other patches.
Yeah seems about right. Patches themselves look good to me now, so would be nice if amd can ack here or in v8.
Series themselves look good, so feel free to add my r-b to entire series: (and Thadeu's t-b)
Reviewed-By: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
>
> Thanks,
> Thomas
>
>
>
>>
>> On 7/7/26 20:05, Arunpravin Paneer Selvam wrote:
>>>
>>>
>>> On 7/3/2026 6:38 PM, Christian König wrote:
>>>> Arun please take a look at this.
>>> Sure Christian. This fix looks correct to me.
>>> Reviewed-by: Arunpravin Paneer Selvam
>>> <Arunpravin.PaneerSelvam@amd.com>
>>>
>>> Thanks,
>>> Arun.
>>>>
>>>> Thanks,
>>>> Christian.
>>>>
>>>> On 7/3/26 15:05, Thomas Hellström wrote:
>>>>> drmm_cgroup_register_region() is called before INIT_LIST_HEAD()
>>>>> and
>>>>> gpu_buddy_init() in amdgpu_vram_mgr_init(). If it fails, the
>>>>> function
>>>>> returns early and bypasses those initializations.
>>>>>
>>>>> Since adev->mman.initialized is set to true before
>>>>> amdgpu_vram_mgr_init()
>>>>> is called, a failure triggers amdgpu_ttm_fini(), which calls
>>>>> amdgpu_vram_mgr_fini(), which then:
>>>>>
>>>>> - Calls list_for_each_entry_safe() on reservations_pending
>>>>> and
>>>>> reserved_pages, whose list_head::next pointers are zero-
>>>>> initialized
>>>>> (NULL). The loop does not recognize them as empty and
>>>>> dereferences NULL.
>>>>>
>>>>> - Calls gpu_buddy_fini(), which iterates free_trees[]
>>>>> unconditionally
>>>>> via for_each_free_tree(). Since mm->free_trees is NULL
>>>>> (never allocated), this dereferences NULL.
>>>>>
>>>>> Both result in a kernel panic on the module load error path.
>>>>>
>>>>> Fix by moving drmm_cgroup_register_region() to after the list
>>>>> and buddy
>>>>> allocator are fully initialized, so the teardown path is safe
>>>>> to run.
>>>>>
>>>>> Reported-by: Sashiko-bot <sashiko-bot@kernel.org>
>>>>> Closes:
>>>>> https://sashiko.dev/#/patchset/20260428073116.15687-1-thomas.hellstrom@linux.intel.com?part=4
>>>>> Fixes: 2b624a2c1865 ("drm/ttm: Handle cgroup based eviction in
>>>>> TTM")
>>>>> Cc: Friedrich Vock <friedrich.vock@gmx.de>
>>>>> Cc: Maarten Lankhorst <dev@lankhorst.se>
>>>>> Cc: Tejun Heo <tj@kernel.org>
>>>>> Cc: Maxime Ripard <mripard@kernel.org>
>>>>> Cc: Christian König <christian.koenig@amd.com>
>>>>> Cc: Alex Deucher <alexander.deucher@amd.com>
>>>>> Cc: amd-gfx@lists.freedesktop.org
>>>>> Cc: dri-devel@lists.freedesktop.org
>>>>> Cc: <stable@vger.kernel.org> # v6.14+
>>>>> Assisted-by: GitHub_Copilot:claude-sonnet-4.6
>>>>> Signed-off-by: Thomas Hellström
>>>>> <thomas.hellstrom@linux.intel.com>
>>>>> ---
>>>>> drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 ++++---
>>>>> 1 file changed, 4 insertions(+), 3 deletions(-)
>>>>>
>>>>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>>>> b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>>>> index 2a241a5b12c4..ac3f71d77140 100644
>>>>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>>>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>>>> @@ -918,9 +918,6 @@ int amdgpu_vram_mgr_init(struct
>>>>> amdgpu_device *adev)
>>>>> struct ttm_resource_manager *man = &mgr->manager;
>>>>> int err;
>>>>> - man->cg = drmm_cgroup_register_region(adev_to_drm(adev),
>>>>> "vram", adev->gmc.real_vram_size);
>>>>> - if (IS_ERR(man->cg))
>>>>> - return PTR_ERR(man->cg);
>>>>> ttm_resource_manager_init(man, &adev->mman.bdev,
>>>>> adev->gmc.real_vram_size);
>>>>> @@ -935,6 +932,10 @@ int amdgpu_vram_mgr_init(struct
>>>>> amdgpu_device *adev)
>>>>> if (err)
>>>>> return err;
>>>>> + man->cg = drmm_cgroup_register_region(adev_to_drm(adev),
>>>>> "vram", adev->gmc.real_vram_size);
>>>>> + if (IS_ERR(man->cg))
>>>>> + return PTR_ERR(man->cg);
>>>>> +
>>>>> ttm_set_driver_manager(&adev->mman.bdev, TTM_PL_VRAM,
>>>>> &mgr->manager);
>>>>> ttm_resource_manager_set_used(man, true);
>>>>> return 0;
>>>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v7 1/6] drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
2026-07-21 12:26 ` Maarten Lankhorst
@ 2026-07-22 9:49 ` Arunpravin Paneer Selvam
0 siblings, 0 replies; 10+ messages in thread
From: Arunpravin Paneer Selvam @ 2026-07-22 9:49 UTC (permalink / raw)
To: Maarten Lankhorst, Thomas Hellström, Christian König,
intel-xe
Cc: Sashiko-bot, Friedrich Vock, Maarten Lankhorst, Tejun Heo,
Maxime Ripard, Alex Deucher, amd-gfx, dri-devel, stable,
Natalie Vock, Johannes Weiner, Michal Koutný, cgroups,
Huang Rui, Matthew Brost, Matthew Auld, Thomas Zimmermann,
Simona Vetter, David Airlie, Thadeu Lima de Souza Cascardo,
Rodrigo Vivi, linux-kernel
On 7/21/2026 5:56 PM, Maarten Lankhorst wrote:
> Hey,
>
> On 7/21/26 14:10, Thomas Hellström wrote:
>> Hi, Maarten,
>>
>> On Tue, 2026-07-21 at 13:46 +0200, Maarten Lankhorst wrote:
>>> Hey,
>>>
>>> Can I merge this through drm-misc-next together with the rest of the
>>> series?
>>>
>>> Kind regards
>>> ~Maarten
>> For the xe patches, Ack from me.
>>
>> I do have a v8 that fixes a sashiko comment on the last patch, though,
>> but I was holding that awaiting a review on the other patches.
> Yeah seems about right. Patches themselves look good to me now, so would be nice if amd can ack here or in v8.
I have already sent my Reviewed-by for this patch.
Reviewed-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Thanks,
Arun.
>
> Series themselves look good, so feel free to add my r-b to entire series: (and Thadeu's t-b)
>
> Reviewed-By: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
>
>> Thanks,
>> Thomas
>>
>>
>>
>>> On 7/7/26 20:05, Arunpravin Paneer Selvam wrote:
>>>>
>>>> On 7/3/2026 6:38 PM, Christian König wrote:
>>>>> Arun please take a look at this.
>>>> Sure Christian. This fix looks correct to me.
>>>> Reviewed-by: Arunpravin Paneer Selvam
>>>> <Arunpravin.PaneerSelvam@amd.com>
>>>>
>>>> Thanks,
>>>> Arun.
>>>>> Thanks,
>>>>> Christian.
>>>>>
>>>>> On 7/3/26 15:05, Thomas Hellström wrote:
>>>>>> drmm_cgroup_register_region() is called before INIT_LIST_HEAD()
>>>>>> and
>>>>>> gpu_buddy_init() in amdgpu_vram_mgr_init(). If it fails, the
>>>>>> function
>>>>>> returns early and bypasses those initializations.
>>>>>>
>>>>>> Since adev->mman.initialized is set to true before
>>>>>> amdgpu_vram_mgr_init()
>>>>>> is called, a failure triggers amdgpu_ttm_fini(), which calls
>>>>>> amdgpu_vram_mgr_fini(), which then:
>>>>>>
>>>>>> - Calls list_for_each_entry_safe() on reservations_pending
>>>>>> and
>>>>>> reserved_pages, whose list_head::next pointers are zero-
>>>>>> initialized
>>>>>> (NULL). The loop does not recognize them as empty and
>>>>>> dereferences NULL.
>>>>>>
>>>>>> - Calls gpu_buddy_fini(), which iterates free_trees[]
>>>>>> unconditionally
>>>>>> via for_each_free_tree(). Since mm->free_trees is NULL
>>>>>> (never allocated), this dereferences NULL.
>>>>>>
>>>>>> Both result in a kernel panic on the module load error path.
>>>>>>
>>>>>> Fix by moving drmm_cgroup_register_region() to after the list
>>>>>> and buddy
>>>>>> allocator are fully initialized, so the teardown path is safe
>>>>>> to run.
>>>>>>
>>>>>> Reported-by: Sashiko-bot <sashiko-bot@kernel.org>
>>>>>> Closes:
>>>>>> https://sashiko.dev/#/patchset/20260428073116.15687-1-thomas.hellstrom@linux.intel.com?part=4
>>>>>> Fixes: 2b624a2c1865 ("drm/ttm: Handle cgroup based eviction in
>>>>>> TTM")
>>>>>> Cc: Friedrich Vock <friedrich.vock@gmx.de>
>>>>>> Cc: Maarten Lankhorst <dev@lankhorst.se>
>>>>>> Cc: Tejun Heo <tj@kernel.org>
>>>>>> Cc: Maxime Ripard <mripard@kernel.org>
>>>>>> Cc: Christian König <christian.koenig@amd.com>
>>>>>> Cc: Alex Deucher <alexander.deucher@amd.com>
>>>>>> Cc: amd-gfx@lists.freedesktop.org
>>>>>> Cc: dri-devel@lists.freedesktop.org
>>>>>> Cc: <stable@vger.kernel.org> # v6.14+
>>>>>> Assisted-by: GitHub_Copilot:claude-sonnet-4.6
>>>>>> Signed-off-by: Thomas Hellström
>>>>>> <thomas.hellstrom@linux.intel.com>
>>>>>> ---
>>>>>> drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 ++++---
>>>>>> 1 file changed, 4 insertions(+), 3 deletions(-)
>>>>>>
>>>>>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>>>>> b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>>>>> index 2a241a5b12c4..ac3f71d77140 100644
>>>>>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>>>>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>>>>> @@ -918,9 +918,6 @@ int amdgpu_vram_mgr_init(struct
>>>>>> amdgpu_device *adev)
>>>>>> struct ttm_resource_manager *man = &mgr->manager;
>>>>>> int err;
>>>>>> - man->cg = drmm_cgroup_register_region(adev_to_drm(adev),
>>>>>> "vram", adev->gmc.real_vram_size);
>>>>>> - if (IS_ERR(man->cg))
>>>>>> - return PTR_ERR(man->cg);
>>>>>> ttm_resource_manager_init(man, &adev->mman.bdev,
>>>>>> adev->gmc.real_vram_size);
>>>>>> @@ -935,6 +932,10 @@ int amdgpu_vram_mgr_init(struct
>>>>>> amdgpu_device *adev)
>>>>>> if (err)
>>>>>> return err;
>>>>>> + man->cg = drmm_cgroup_register_region(adev_to_drm(adev),
>>>>>> "vram", adev->gmc.real_vram_size);
>>>>>> + if (IS_ERR(man->cg))
>>>>>> + return PTR_ERR(man->cg);
>>>>>> +
>>>>>> ttm_set_driver_manager(&adev->mman.bdev, TTM_PL_VRAM,
>>>>>> &mgr->manager);
>>>>>> ttm_resource_manager_set_used(man, true);
>>>>>> return 0;
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v7 1/6] drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
2026-07-03 13:11 ` Thomas Hellström
@ 2026-07-22 9:58 ` Arunpravin Paneer Selvam
0 siblings, 0 replies; 10+ messages in thread
From: Arunpravin Paneer Selvam @ 2026-07-22 9:58 UTC (permalink / raw)
To: Thomas Hellström, Christian König, intel-xe
Cc: Sashiko-bot, Friedrich Vock, Maarten Lankhorst, Tejun Heo,
Maxime Ripard, Alex Deucher, amd-gfx, dri-devel, stable,
Natalie Vock, Johannes Weiner, Michal Koutný, cgroups,
Huang Rui, Matthew Brost, Matthew Auld, Maarten Lankhorst,
Thomas Zimmermann, Simona Vetter, David Airlie,
Thadeu Lima de Souza Cascardo, Rodrigo Vivi, linux-kernel
On 7/3/2026 6:41 PM, Thomas Hellström wrote:
> On Fri, 2026-07-03 at 15:08 +0200, Christian König wrote:
>> Arun please take a look at this.
>>
>> Thanks,
>> Christian.
> FWIW Sashiko claims there is yet another pre-existing bug WRT ordering
> here, but since the fix wasn't needed for the rest of the series, I
> focused on this one.
Thanks for pointing that out. I have sent a fix for the pre-existing bug
reported by Sashiko as a separate patch.
https://patchwork.freedesktop.org/patch/741782/
Thanks,
Arun.
>
> Thanks,
> Thomas
>
>
>> On 7/3/26 15:05, Thomas Hellström wrote:
>>> drmm_cgroup_register_region() is called before INIT_LIST_HEAD() and
>>> gpu_buddy_init() in amdgpu_vram_mgr_init(). If it fails, the
>>> function
>>> returns early and bypasses those initializations.
>>>
>>> Since adev->mman.initialized is set to true before
>>> amdgpu_vram_mgr_init()
>>> is called, a failure triggers amdgpu_ttm_fini(), which calls
>>> amdgpu_vram_mgr_fini(), which then:
>>>
>>> - Calls list_for_each_entry_safe() on reservations_pending and
>>> reserved_pages, whose list_head::next pointers are zero-
>>> initialized
>>> (NULL). The loop does not recognize them as empty and
>>> dereferences NULL.
>>>
>>> - Calls gpu_buddy_fini(), which iterates free_trees[]
>>> unconditionally
>>> via for_each_free_tree(). Since mm->free_trees is NULL
>>> (never allocated), this dereferences NULL.
>>>
>>> Both result in a kernel panic on the module load error path.
>>>
>>> Fix by moving drmm_cgroup_register_region() to after the list and
>>> buddy
>>> allocator are fully initialized, so the teardown path is safe to
>>> run.
>>>
>>> Reported-by: Sashiko-bot <sashiko-bot@kernel.org>
>>> Closes:
>>> https://sashiko.dev/#/patchset/20260428073116.15687-1-thomas.hellstrom@linux.intel.com?part=4
>>> Fixes: 2b624a2c1865 ("drm/ttm: Handle cgroup based eviction in
>>> TTM")
>>> Cc: Friedrich Vock <friedrich.vock@gmx.de>
>>> Cc: Maarten Lankhorst <dev@lankhorst.se>
>>> Cc: Tejun Heo <tj@kernel.org>
>>> Cc: Maxime Ripard <mripard@kernel.org>
>>> Cc: Christian König <christian.koenig@amd.com>
>>> Cc: Alex Deucher <alexander.deucher@amd.com>
>>> Cc: amd-gfx@lists.freedesktop.org
>>> Cc: dri-devel@lists.freedesktop.org
>>> Cc: <stable@vger.kernel.org> # v6.14+
>>> Assisted-by: GitHub_Copilot:claude-sonnet-4.6
>>> Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>>> ---
>>> drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 ++++---
>>> 1 file changed, 4 insertions(+), 3 deletions(-)
>>>
>>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>> b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>> index 2a241a5b12c4..ac3f71d77140 100644
>>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>> @@ -918,9 +918,6 @@ int amdgpu_vram_mgr_init(struct amdgpu_device
>>> *adev)
>>> struct ttm_resource_manager *man = &mgr->manager;
>>> int err;
>>>
>>> - man->cg = drmm_cgroup_register_region(adev_to_drm(adev),
>>> "vram", adev->gmc.real_vram_size);
>>> - if (IS_ERR(man->cg))
>>> - return PTR_ERR(man->cg);
>>> ttm_resource_manager_init(man, &adev->mman.bdev,
>>> adev->gmc.real_vram_size);
>>>
>>> @@ -935,6 +932,10 @@ int amdgpu_vram_mgr_init(struct amdgpu_device
>>> *adev)
>>> if (err)
>>> return err;
>>>
>>> + man->cg = drmm_cgroup_register_region(adev_to_drm(adev),
>>> "vram", adev->gmc.real_vram_size);
>>> + if (IS_ERR(man->cg))
>>> + return PTR_ERR(man->cg);
>>> +
>>> ttm_set_driver_manager(&adev->mman.bdev, TTM_PL_VRAM,
>>> &mgr->manager);
>>> ttm_resource_manager_set_used(man, true);
>>> return 0;
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v7 1/6] drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
2026-07-21 11:46 ` Maarten Lankhorst
2026-07-21 12:10 ` Thomas Hellström
@ 2026-08-03 12:30 ` Christian König
1 sibling, 0 replies; 10+ messages in thread
From: Christian König @ 2026-08-03 12:30 UTC (permalink / raw)
To: Maarten Lankhorst, Arunpravin Paneer Selvam,
Thomas Hellström, intel-xe
Cc: Sashiko-bot, Friedrich Vock, Maarten Lankhorst, Tejun Heo,
Maxime Ripard, Alex Deucher, amd-gfx, dri-devel, stable,
Natalie Vock, Johannes Weiner, Michal Koutný, cgroups,
Huang Rui, Matthew Brost, Matthew Auld, Thomas Zimmermann,
Simona Vetter, David Airlie, Thadeu Lima de Souza Cascardo,
Rodrigo Vivi, linux-kernel
On 7/21/26 13:46, Maarten Lankhorst wrote:
> Hey,
>
> Can I merge this through drm-misc-next together with the rest of the series?
Sure go ahead, sorry for the delay I was on vacation for a while.
Regards,
Christian.
>
> Kind regards
> ~Maarten
>
> On 7/7/26 20:05, Arunpravin Paneer Selvam wrote:
>>
>>
>> On 7/3/2026 6:38 PM, Christian König wrote:
>>> Arun please take a look at this.
>> Sure Christian. This fix looks correct to me.
>> Reviewed-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
>>
>> Thanks,
>> Arun.
>>>
>>> Thanks,
>>> Christian.
>>>
>>> On 7/3/26 15:05, Thomas Hellström wrote:
>>>> drmm_cgroup_register_region() is called before INIT_LIST_HEAD() and
>>>> gpu_buddy_init() in amdgpu_vram_mgr_init(). If it fails, the function
>>>> returns early and bypasses those initializations.
>>>>
>>>> Since adev->mman.initialized is set to true before amdgpu_vram_mgr_init()
>>>> is called, a failure triggers amdgpu_ttm_fini(), which calls
>>>> amdgpu_vram_mgr_fini(), which then:
>>>>
>>>> - Calls list_for_each_entry_safe() on reservations_pending and
>>>> reserved_pages, whose list_head::next pointers are zero-initialized
>>>> (NULL). The loop does not recognize them as empty and dereferences NULL.
>>>>
>>>> - Calls gpu_buddy_fini(), which iterates free_trees[] unconditionally
>>>> via for_each_free_tree(). Since mm->free_trees is NULL
>>>> (never allocated), this dereferences NULL.
>>>>
>>>> Both result in a kernel panic on the module load error path.
>>>>
>>>> Fix by moving drmm_cgroup_register_region() to after the list and buddy
>>>> allocator are fully initialized, so the teardown path is safe to run.
>>>>
>>>> Reported-by: Sashiko-bot <sashiko-bot@kernel.org>
>>>> Closes: https://sashiko.dev/#/patchset/20260428073116.15687-1-thomas.hellstrom@linux.intel.com?part=4
>>>> Fixes: 2b624a2c1865 ("drm/ttm: Handle cgroup based eviction in TTM")
>>>> Cc: Friedrich Vock <friedrich.vock@gmx.de>
>>>> Cc: Maarten Lankhorst <dev@lankhorst.se>
>>>> Cc: Tejun Heo <tj@kernel.org>
>>>> Cc: Maxime Ripard <mripard@kernel.org>
>>>> Cc: Christian König <christian.koenig@amd.com>
>>>> Cc: Alex Deucher <alexander.deucher@amd.com>
>>>> Cc: amd-gfx@lists.freedesktop.org
>>>> Cc: dri-devel@lists.freedesktop.org
>>>> Cc: <stable@vger.kernel.org> # v6.14+
>>>> Assisted-by: GitHub_Copilot:claude-sonnet-4.6
>>>> Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>>>> ---
>>>> drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 ++++---
>>>> 1 file changed, 4 insertions(+), 3 deletions(-)
>>>>
>>>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>>> index 2a241a5b12c4..ac3f71d77140 100644
>>>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
>>>> @@ -918,9 +918,6 @@ int amdgpu_vram_mgr_init(struct amdgpu_device *adev)
>>>> struct ttm_resource_manager *man = &mgr->manager;
>>>> int err;
>>>> - man->cg = drmm_cgroup_register_region(adev_to_drm(adev), "vram", adev->gmc.real_vram_size);
>>>> - if (IS_ERR(man->cg))
>>>> - return PTR_ERR(man->cg);
>>>> ttm_resource_manager_init(man, &adev->mman.bdev,
>>>> adev->gmc.real_vram_size);
>>>> @@ -935,6 +932,10 @@ int amdgpu_vram_mgr_init(struct amdgpu_device *adev)
>>>> if (err)
>>>> return err;
>>>> + man->cg = drmm_cgroup_register_region(adev_to_drm(adev), "vram", adev->gmc.real_vram_size);
>>>> + if (IS_ERR(man->cg))
>>>> + return PTR_ERR(man->cg);
>>>> +
>>>> ttm_set_driver_manager(&adev->mman.bdev, TTM_PL_VRAM, &mgr->manager);
>>>> ttm_resource_manager_set_used(man, true);
>>>> return 0;
>>
>
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2026-08-03 12:31 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20260703130541.2686-1-thomas.hellstrom@linux.intel.com>
2026-07-03 13:05 ` [PATCH v7 1/6] drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init() Thomas Hellström
2026-07-03 13:08 ` Christian König
2026-07-03 13:11 ` Thomas Hellström
2026-07-22 9:58 ` Arunpravin Paneer Selvam
2026-07-07 18:05 ` Arunpravin Paneer Selvam
2026-07-21 11:46 ` Maarten Lankhorst
2026-07-21 12:10 ` Thomas Hellström
2026-07-21 12:26 ` Maarten Lankhorst
2026-07-22 9:49 ` Arunpravin Paneer Selvam
2026-08-03 12:30 ` Christian König
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).