On Thu, Oct 29, 2026 at 04:19:24PM +0800, 潘煜杭 wrote: > > Unpinning a buffer object does not change its memory placement. > Placement revalidation is unnecessary. Currently > vmw_bo_pin_reserved() calls ttm_bo_validate() for both pin and unpin > operations and treats any validation error as impossible with BUG_ON(). > > During PRIME/GEM cleanup, vmw_gem_object_unpin() calls > vmw_bo_pin_reserved(vbo, false). The Linux 7.3-based QEMU reproducer > confirmed that ttm_bo_validate() returned -EINVAL. The following BUG_ON() > crashed the kernel during process exit. > > The relevant report excerpt is: > > [ 72.916147] [BO_PIN_TRACE] before-validate pin=0 old_mem_type=0 > target_mem_type=0 flags=0x10 > [ 72.916201] [BO_PIN_TRACE] after-validate ret=-22 old_mem_type=0 > new_mem_type=0 ... > [ 72.918841] kernel BUG at drivers/gpu/drm/vmwgfx/vmwgfx_bo.c:342! > [ 72.918892] Oops: invalid opcode: 0000 [#1] SMP NOPTI > [ 72.933292] CPU: 1 UID: 0 PID: 346 Comm: repro_vmwgfx_bo > Not tainted 7.3.0-dirty #2 PREEMPT(lazy) > [ 72.937912] RIP: 0010:vmw_bo_pin_reserved+0x36d/0x380 > [ 72.947235] RBP: 00000000ffffffea > [ 72.990254] Fixing recursive fault but reboot is needed! > > The reproducer created a dumb GEM buffer, exported/imported its PRIME fd, > performed GEM flink/open/close operations, and exited. During exit_group(), > the call path was vmw_gem_object_unpin() -> drm_gem_map_detach() -> > dma_buf_detach() -> drm_prime_gem_destroy() -> drm_gem_shmem_release() -> > vmw_bo_pin_reserved(). > > The fix skips ttm_bo_validate() when unpinning. Validation remains on the > pin path before ttm_bo_pin(). > > Assisted-by: OpenAI Codex (GPT-5) > Signed-off-by: Yuhang Pan <[email protected]> > --- > drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c > b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c > index 9c7a73c..14d28e2 100644 > --- a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c > +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c > @@ -308,6 +308,11 @@ void vmw_bo_pin_reserved(struct vmw_bo *vbo, bool pin) > if (pin == !!bo->pin_count) > return; > > + if (!pin) { > + ttm_bo_unpin(bo); > + return; > + } > + > pl.fpfn = 0; > pl.lpfn = 0; > pl.mem_type = bo->resource->mem_type; > @@ -321,8 +326,5 @@ void vmw_bo_pin_reserved(struct vmw_bo *vbo, bool pin) > > BUG_ON(ret != 0 || bo->resource->mem_type != old_mem_type); > > - if (pin) > - ttm_bo_pin(bo); > - else > - ttm_bo_unpin(bo); > + ttm_bo_pin(bo); > } > > -- > 2.34.1
This patch is corrupted and can not be applied :( Also, no Fixes: or cc: stable tags? thanks, greg k-h
