Re: [PATCH] drm/lima: Drain fence callbacks before destroying slab

[Qiang Yu]

Reviewed-by: Qiang Yu <yuq825@xxxxxxxxx>

On Sat, Oct 3, 2026 at 5:39 PM Jiale Yao <yaojiale02@xxxxxxx> wrote:
>
> lima_fence_release() defers freeing fences from lima_fence_slab to an
> RCU callback. The last lima_sched_slab_fini() can destroy the slab and
> clear its pointer while a release callback is still queued. Module removal
> can also free lima_fence_release_rcu() before that callback runs.
>
> Drain outstanding callbacks before destroying the last fence slab.
>
> Fixes: a1d2a6339961 ("drm/lima: driver for ARM Mali4xx GPUs")
> Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
> ---
>  drivers/gpu/drm/lima/lima_sched.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/gpu/drm/lima/lima_sched.c b/drivers/gpu/drm/lima/lima_sched.c
> index 9a1e6b9ecbe5..9c5ff1929d3e 100644
> --- a/drivers/gpu/drm/lima/lima_sched.c
> +++ b/drivers/gpu/drm/lima/lima_sched.c
> @@ -44,6 +44,7 @@ int lima_sched_slab_init(void)
>  void lima_sched_slab_fini(void)
>  {
>         if (!--lima_fence_slab_refcnt) {
> +               rcu_barrier();
>                 kmem_cache_destroy(lima_fence_slab);
>                 lima_fence_slab = NULL;
>         }
> --
> 2.34.1
>