From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: drm/vmwgfx: Break ABBA deadlock in vblank disable path Date: Mon, 25 May 2026 18:39:18 +1000 Message-ID: In-Reply-To: <20260522123526.567109-1-w15303746062@163.com> References: <20260522123526.567109-1-w15303746062@163.com> <20260522123526.567109-1-w15303746062@163.com> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 Patch Review **Status: Superseded by upstream refactoring** **The bug analysis is correct.** The commit message accurately describes the ABBA deadlock: `drm_crtc_vblank_off()` holds `dev->vbl_lock` and calls `disable_vblank()`, which called blocking `hrtimer_cancel()`, while the timer callback calls `drm_crtc_handle_vblank()` which tries to acquire `dev->vbl_lock`. This is a legitimate deadlock scenario. **The fix approach has a correctness gap.** In `vmw_vkms_disable_vblank()`: ```c - hrtimer_cancel(&du->vkms.timer); + hrtimer_try_to_cancel(&du->vkms.timer); du->vkms.surface = NULL; ``` `hrtimer_try_to_cancel()` returns `-1` if the timer callback is currently executing, meaning the cancel did not happen. The patch then sets `du->vkms.surface = NULL` regardless, so a still-running timer callback could race against the surface being cleared. The follow-up `hrtimer_cancel()` in `vmw_vkms_crtc_atomic_disable()` would eventually synchronize, but between the `try_to_cancel` and the later `hrtimer_cancel`, the timer callback may fire again and access the now-NULL surface pointer. **The upstream fix is superior.** In drm-next, the entire vblank timer has been moved into the DRM core (`struct drm_vblank_crtc_timer`). The `vmw_vkms_disable_vblank()` now calls `drm_crtc_vblank_cancel_timer(crtc)` which internally uses `hrtimer_try_to_cancel()` with proper interval-zeroing under a spinlock, and the old `du->vkms.timer` field no longer exists. The `vmw_vkms_crtc_atomic_disable()` function no longer needs a separate `hrtimer_cancel()` call. **Minor style issues (moot given NAK):** - The `period_ns` line (`du->vkms.period_ns = ktime_set(0, 0)`) was removed in the diff context but this field no longer exists upstream either. - The added comments, while accurate, are somewhat verbose for kernel style. **Recommendation:** This patch should be rejected. The underlying bug was real but has been fixed by the vblank timer infrastructure refactoring already in drm-next. If the submitter is targeting a stable kernel that predates that refactoring, they should note the target branch and add a `Fixes:` tag identifying the commit that introduced the original `hrtimer_cancel()` call, along with a `Cc: stable@vger.kernel.org` tag. --- Generated by Claude Code Patch Reviewer