Re: [PATCH] drm/vmwgfx: unpin BOs without revalidating placement

[Greg KH]

On Thu, Oct 29, 2026 at 04:19:24PM +0800, 潘煜杭 wrote:
> 
> Unpinning a buffer object does not change its memory placement.
> Placement revalidation is unnecessary. Currently
> vmw_bo_pin_reserved() calls ttm_bo_validate() for both pin and unpin
> operations and treats any validation error as impossible with BUG_ON().
> 
> During PRIME/GEM cleanup, vmw_gem_object_unpin() calls
> vmw_bo_pin_reserved(vbo, false). The Linux 7.3-based QEMU reproducer
> confirmed that ttm_bo_validate() returned -EINVAL. The following BUG_ON()
> crashed the kernel during process exit. 
> 
> The relevant report excerpt is:
> 
>   [   72.916147] [BO_PIN_TRACE] before-validate pin=0 old_mem_type=0 target_mem_type=0 flags=0x10
>   [   72.916201] [BO_PIN_TRACE] after-validate ret=-22 old_mem_type=0 new_mem_type=0 ...
>   [   72.918841] kernel BUG at drivers/gpu/drm/vmwgfx/vmwgfx_bo.c:342!
>   [   72.918892] Oops: invalid opcode: 0000 [#1] SMP NOPTI
>   [   72.933292] CPU: 1 UID: 0 PID: 346 Comm: repro_vmwgfx_bo
>                Not tainted 7.3.0-dirty #2 PREEMPT(lazy)
>   [   72.937912] RIP: 0010:vmw_bo_pin_reserved+0x36d/0x380
>   [   72.947235] RBP: 00000000ffffffea
>   [   72.990254] Fixing recursive fault but reboot is needed!
> 
> The reproducer created a dumb GEM buffer, exported/imported its PRIME fd,
> performed GEM flink/open/close operations, and exited. During exit_group(),
> the call path was vmw_gem_object_unpin() -> drm_gem_map_detach() ->
> dma_buf_detach() -> drm_prime_gem_destroy() -> drm_gem_shmem_release() ->
> vmw_bo_pin_reserved().
> 
> The fix skips ttm_bo_validate() when unpinning. Validation remains on the
> pin path before ttm_bo_pin().
> 
> Assisted-by: OpenAI Codex (GPT-5)
> Signed-off-by: Yuhang Pan <242270054@xxxxxxxxxx>
> ---
>  drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
> index 9c7a73c..14d28e2 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
> @@ -308,6 +308,11 @@ void vmw_bo_pin_reserved(struct vmw_bo *vbo, bool pin)
>      if (pin == !!bo->pin_count)
>          return;
>  
> +    if (!pin) {
> +        ttm_bo_unpin(bo);
> +        return;
> +    }
> +
>      pl.fpfn = 0;
>      pl.lpfn = 0;
>      pl.mem_type = bo->resource->mem_type;
> @@ -321,8 +326,5 @@ void vmw_bo_pin_reserved(struct vmw_bo *vbo, bool pin)
>  
>      BUG_ON(ret != 0 || bo->resource->mem_type != old_mem_type);
>  
> -    if (pin)
> -        ttm_bo_pin(bo);
> -    else
> -        ttm_bo_unpin(bo);
> +    ttm_bo_pin(bo);
>  }
> 
> -- 
> 2.34.1

This patch is corrupted and can not be applied :(

Also, no Fixes: or cc: stable tags?

thanks,

greg k-h