Unpinning a buffer object does not change its memory placement. Placement revalidation is unnecessary. Currently vmw_bo_pin_reserved() calls ttm_bo_validate() for both pin and unpin operations and treats any validation error as impossible with BUG_ON().
During PRIME/GEM cleanup, vmw_gem_object_unpin() calls vmw_bo_pin_reserved(vbo, false). The Linux 7.3-based QEMU reproducer confirmed that ttm_bo_validate() returned -EINVAL. The following BUG_ON() crashed the kernel during process exit. The relevant report excerpt is: [ 72.916147] [BO_PIN_TRACE] before-validate pin=0 old_mem_type=0 target_mem_type=0 flags=0x10 [ 72.916201] [BO_PIN_TRACE] after-validate ret=-22 old_mem_type=0 new_mem_type=0 ... [ 72.918841] kernel BUG at drivers/gpu/drm/vmwgfx/vmwgfx_bo.c:342! [ 72.918892] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 72.933292] CPU: 1 UID: 0 PID: 346 Comm: repro_vmwgfx_bo Not tainted 7.3.0-dirty #2 PREEMPT(lazy) [ 72.937912] RIP: 0010:vmw_bo_pin_reserved+0x36d/0x380 [ 72.947235] RBP: 00000000ffffffea [ 72.990254] Fixing recursive fault but reboot is needed! The reproducer created a dumb GEM buffer, exported/imported its PRIME fd, performed GEM flink/open/close operations, and exited. During exit_group(), the call path was vmw_gem_object_unpin() -> drm_gem_map_detach() -> dma_buf_detach() -> drm_prime_gem_destroy() -> drm_gem_shmem_release() -> vmw_bo_pin_reserved(). The fix skips ttm_bo_validate() when unpinning. Validation remains on the pin path before ttm_bo_pin(). Assisted-by: OpenAI Codex (GPT-5) Signed-off-by: Yuhang Pan <[email protected]> --- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c index 9c7a73c..14d28e2 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c @@ -308,6 +308,11 @@ void vmw_bo_pin_reserved(struct vmw_bo *vbo, bool pin) if (pin == !!bo->pin_count) return; + if (!pin) { + ttm_bo_unpin(bo); + return; + } + pl.fpfn = 0; pl.lpfn = 0; pl.mem_type = bo->resource->mem_type; @@ -321,8 +326,5 @@ void vmw_bo_pin_reserved(struct vmw_bo *vbo, bool pin) BUG_ON(ret != 0 || bo->resource->mem_type != old_mem_type); - if (pin) - ttm_bo_pin(bo); - else - ttm_bo_unpin(bo); + ttm_bo_pin(bo); } -- 2.34.1 Regards, Yuhang Pan [email protected]
