> From: Nguyen Ngoc Thang <[email protected]> > > virtio_gpu_queue_ctrl_sgs() drops the command when drm_dev_enter() > fails or when vqs_released is set during device removal. It unlocks the > reservations and frees the vbuf, but never releases the GEM object > references that the caller transferred in vbuf->objs. Those references > are normally dropped by the dequeue worker once the host completes the > command, which never happens for a command that was not queued. > > If a framebuffer flush or transfer (e.g. the fbdev damage worker) races > with device removal, the GEM object backing the buffer keeps a stale > reference and is never freed. GEM objects do not hold a reference on the > drm_device, so the device is still released, with the object's node left > in the vma offset manager: > > [ ... ] > Link: > https://lore.kernel.org/all/[email protected]/ > Signed-off-by: Nguyen Ngoc Thang <[email protected]> > [fei.yu: also handle the vmalloc_to_sgt() failure path, pass the fence > to the helper instead of a bool, fix the Fixes tags] > Signed-off-by: Fei Yu <[email protected]>
Sashiko has reviewed this patch and found no issues. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
