diff options
| author | Pierre-Eric Pelloux-Prayer <[email protected]> | 2025-09-01 12:40:32 +0000 |
|---|---|---|
| committer | Maxime Ripard <[email protected]> | 2025-09-02 10:58:56 +0000 |
| commit | 232674e1a6dd2f7a68b0d496a7ed1a57d79533da (patch) | |
| tree | 925493261fb2917f2536c2fccb557a640504beee /drivers/gpu/drm/scheduler/sched_entity.c | |
| parent | accel/ivpu: Prevent recovery work from being queued during device removal (diff) | |
| download | kernel-232674e1a6dd2f7a68b0d496a7ed1a57d79533da.tar.gz kernel-232674e1a6dd2f7a68b0d496a7ed1a57d79533da.zip | |
drm/sched: Fix racy access to drm_sched_entity.dependency
The drm_sched_job_unschedulable trace point can access
entity->dependency after it was cleared by the callback
installed in drm_sched_entity_add_dependency_cb, causing:
BUG: kernel NULL pointer dereference, address: 0000000000000020
[...]
Workqueue: comp_1.1.0 drm_sched_run_job_work [gpu_sched]
RIP: 0010:trace_event_raw_event_drm_sched_job_unschedulable+0x70/0xd0 [gpu_sched]
To fix this we either need to keep a reference to the fence before
setting up the callbacks, or move the trace_drm_sched_job_unschedulable
calls into drm_sched_entity_add_dependency_cb where they can be
done earlier.
Fixes: 76d97c870f29 ("drm/sched: Trace dependencies for GPU jobs")
Signed-off-by: Pierre-Eric Pelloux-Prayer <[email protected]>
Reviewed-by: Tvrtko Ursulin <[email protected]>
Signed-off-by: Philipp Stanner <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
(cherry picked from commit b2b8af21fec35be417a3199b5a6c354605dd222a)
Signed-off-by: Maxime Ripard <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/scheduler/sched_entity.c')
| -rw-r--r-- | drivers/gpu/drm/scheduler/sched_entity.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c index 8867b95ab089..3d06f72531ba 100644 --- a/drivers/gpu/drm/scheduler/sched_entity.c +++ b/drivers/gpu/drm/scheduler/sched_entity.c @@ -391,7 +391,8 @@ EXPORT_SYMBOL(drm_sched_entity_set_priority); * Add a callback to the current dependency of the entity to wake up the * scheduler when the entity becomes available. */ -static bool drm_sched_entity_add_dependency_cb(struct drm_sched_entity *entity) +static bool drm_sched_entity_add_dependency_cb(struct drm_sched_entity *entity, + struct drm_sched_job *sched_job) { struct drm_gpu_scheduler *sched = entity->rq->sched; struct dma_fence *fence = entity->dependency; @@ -421,6 +422,10 @@ static bool drm_sched_entity_add_dependency_cb(struct drm_sched_entity *entity) entity->dependency = fence; } + if (trace_drm_sched_job_unschedulable_enabled() && + !test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &entity->dependency->flags)) + trace_drm_sched_job_unschedulable(sched_job, entity->dependency); + if (!dma_fence_add_callback(entity->dependency, &entity->cb, drm_sched_entity_wakeup)) return true; @@ -461,10 +466,8 @@ struct drm_sched_job *drm_sched_entity_pop_job(struct drm_sched_entity *entity) while ((entity->dependency = drm_sched_job_dependency(sched_job, entity))) { - if (drm_sched_entity_add_dependency_cb(entity)) { - trace_drm_sched_job_unschedulable(sched_job, entity->dependency); + if (drm_sched_entity_add_dependency_cb(entity, sched_job)) return NULL; - } } /* skip jobs from entity that marked guilty */ |