From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 79C02F54AAA for ; Tue, 24 Mar 2026 13:07:57 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id CE87310E5B0; Tue, 24 Mar 2026 13:07:56 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=bootlin.com header.i=@bootlin.com header.b="QcbodRRZ"; dkim-atps=neutral Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) by gabe.freedesktop.org (Postfix) with ESMTPS id 2F9E110E58D; Tue, 24 Mar 2026 13:07:54 +0000 (UTC) Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id 1EBBE1A2FC6; Tue, 24 Mar 2026 13:07:53 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id E5B506011D; Tue, 24 Mar 2026 13:07:52 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id CC98510451277; Tue, 24 Mar 2026 14:07:44 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1774357670; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=fzs1pWNycSsS39sE+twHeUSR+qT4+7glSHwX8hsiv/I=; b=QcbodRRZQ7IqeUKtkAQoCsXRCzX49zCQ7c/T+hCSVAXapnmgLoW9sIiyhNT46+mtFpU61J gJKeSKsjZKwJOSysmrVxJF3olbTeDJZ2DqVTCNwCP9TRBajYIcDIENx5tLs+7THxp2dWu0 G/nuEQt7uiBb0r0BIkhRCZVn6pXSbqYfjcLzD/L4CbpSNR9WLcFeTQpZ4rS6QK/GzA8nkX h9C6LEGO1+qyCWSTqAgOYNv4hY+3xqTMYTAflOF0bmF5eF20QckGAirTPjA+Op1MqF0Nv7 40zg4pJn5YPXFwI/uVYiiJu5XpAy2TfiMXAYQmP7sGyJ6NVFPthK0xMFXjZ6wA== From: Luca Ceresoli Date: Tue, 24 Mar 2026 14:07:30 +0100 Subject: [PATCH v3] drm/atomic: drm_atomic_private_obj_fini: protect private_obj removal from list MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260324-drm-bridge-atomic-vs-remove-private_obj-v3-1-64deefe84044@bootlin.com> References: <20260324-drm-bridge-atomic-vs-remove-private_obj-v3-0-64deefe84044@bootlin.com> In-Reply-To: <20260324-drm-bridge-atomic-vs-remove-private_obj-v3-0-64deefe84044@bootlin.com> To: Harry Wentland , Leo Li , Rodrigo Siqueira , Alex Deucher , =?utf-8?q?Christian_K=C3=B6nig?= , David Airlie , Simona Vetter , Liviu Dudau , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Paul Cercueil , Rob Clark , Dmitry Baryshkov , Abhinav Kumar , Sean Paul , Marijn Suijten , Tomi Valkeinen , Thierry Reding , Mikko Perttunen , Jonathan Hunter , Dave Stevenson , =?utf-8?q?Ma=C3=ADra_Canal?= , Raspberry Pi Kernel Maintenance Cc: Hui Pu , Thomas Petazzoni , amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, linux-mips@vger.kernel.org, linux-arm-msm@vger.kernel.org, freedreno@lists.freedesktop.org, linux-tegra@vger.kernel.org, Ian Ray , Luca Ceresoli X-Mailer: b4 0.15.0 X-Last-TLS-Session-Version: TLSv1.3 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Currently drm_bridge_detach() expects that the bridge private_obj is not locked by a drm_modeset_acquire_ctx, and it warns in case that happens: drm_bridge_detach() -> drm_atomic_private_obj_fini() -> list_del(&obj->head) // removes priv_obj from // dev->mode_config.privobj_list -> obj->funcs->atomic_destroy_state() -> drm_modeset_lock_fini(&obj->lock) -> WARN_ON(!list_empty(&lock->head)) // warn if priv_obj->lock // is still in ctx->locked The expectation is not respected when introducing bridge hot-plugging. In such case the warning triggers if the bridge is being removed concurrently to an operation that locks the private object using a drm_modeset_acquire_ctx, such as in this execution scenario: CPU0: drm_mode_obj_get_properties_ioctl() // userspace request -> DRM_MODESET_LOCK_ALL_BEGIN() . -> drm_for_each_privobj() // loop on dev->mode_config.privobj_list . - lock the privobj mutex . - add priv_obj->lock to ctx->locked . (list of locks to be released later) . . CPU1: . drm_bridge_detach() // bridge hot-unplug . -> WARN triggers! . -> DRM_MODESET_LOCK_ALL_END() -> for each lock in ctx->locked - remove priv_obj->lock from ctx->locked - unlock the privobj mutex Prevent this potential deadlock by using DRM_MODESET_LOCK_ALL_BEGIN/END() around the list removal in drm_atomic_private_obj_fini(). This ensures that exactly one of these happens: * the concurrent code (e.g. drm_mode_obj_get_properties_ioctl()) acquires all the locks first, so it can execute fully and release the privobj->lock before drm_atomic_private_obj_fini() calls list_del() and before the WARN_ON() * drm_atomic_private_obj_fini() acquires all the locks first, so it removes its privobj->lock from the dev->mode_config.privobj_list; the concurrent code will run afterwards and not acquire that lock because it is not present anymore Signed-off-by: Luca Ceresoli --- Changes in v3: - Rebased on current drm-misc-next (on 7.0-rc3) - Small commit message clarification Changes in v2: - added 'drm/atomic:' prefix to commit title - Adapted to work on top of "drm/atomic: Add dev pointer to drm_private_obj" - Slightly improved commit message --- drivers/gpu/drm/drm_atomic.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index 41c57063f3b4..0f9c2528c9ee 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -962,7 +962,13 @@ EXPORT_SYMBOL(drm_atomic_private_obj_init); void drm_atomic_private_obj_fini(struct drm_private_obj *obj) { + struct drm_modeset_acquire_ctx ctx; + int ret = 0; + + DRM_MODESET_LOCK_ALL_BEGIN(obj->dev, ctx, 0, ret); list_del(&obj->head); + DRM_MODESET_LOCK_ALL_END(obj->dev, ctx, ret); + obj->funcs->atomic_destroy_state(obj, obj->state); drm_modeset_lock_fini(&obj->lock); } -- 2.53.0