vmw_cursor_mob_destroy() unpins cursor MOBs when discarding an image from
the plane's cache or destroying the cursor plane. It calls ttm_bo_unpin()
without reserving the BO, although TTM requires its reservation to be held
when changing pin counts and LRU membership.
KMS clients issuing repeated nonblocking cursor updates can exhaust the
cache and reach this path. On a lockdep-enabled kernel this triggers
reservation assertions in ttm_bo_unpin() and ttm_resource_unevictable().
Reserve the MOB around ttm_bo_unpin(), then release the reservation before
dropping the BO reference.
Fixes: 485d98d472d5 ("drm/vmwgfx: Add support for CursorMob and CursorBypass 4")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Zack Rusin <[email protected]>
---
drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
b/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
index 9e8ea9e07f40..b678e5b68db7 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
@@ -166,10 +166,17 @@ static u32 vmw_cursor_mob_size(enum
vmw_cursor_update_type update_type,
static void vmw_cursor_mob_destroy(struct vmw_bo **vbo)
{
+ int ret;
+
if (!(*vbo))
return;
+ ret = ttm_bo_reserve(&(*vbo)->tbo, false, false, NULL);
+ if (WARN_ON_ONCE(ret))
+ return;
+
ttm_bo_unpin(&(*vbo)->tbo);
+ ttm_bo_unreserve(&(*vbo)->tbo);
vmw_bo_unreference(vbo);
}
--
2.53.0
