From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 590FA331EC5 for ; Sat, 20 Jun 2026 15:53:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781970800; cv=none; b=LL4sUgYfd7HnCYEVRM/V+YysR75umFOAumHLGofZicUOJSGALPJND9HrcNl34RMMqAaZhpl76I95F031TkY0A4vSXE+0dDHJ9zWyq84ALyxC8GcPrKjPRtuU94ItrHRxyzrPGzwu4zlwBM0846+6+UnQIPVgCIzM6lLfqc7Ig08= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781970800; c=relaxed/simple; bh=cx423vxOHZ5cZ5p2QjOF4UP4+rrAGgEQgVaNwvuRyVQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ju9t7u1IxGF1ZwOCC+jtuF/djpVA1CUkMi7vXL72P9tdgk9MDz3ZdkiU7HlfYaSbFObijZdsTRX1mgGX/5UgvQQRcBWAcR/VajF2vwOmAx/2mCCsAMFfdqFAM0CPNeLWJKVgHWaRKh4sLJ3xfy+pU5N/Ori7+ASR1cFv4FlW7u4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=I6o0GKIe; arc=none smtp.client-ip=209.85.210.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="I6o0GKIe" Received: by mail-pf1-f173.google.com with SMTP id d2e1a72fcca58-8453b56ab74so1568390b3a.3 for ; Sat, 20 Jun 2026 08:53:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781970798; x=1782575598; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=t3oRoBnDVYl3gPZelBeVqw/jUzlCT3WUncuxAr44dxE=; b=I6o0GKIelshDDB3waI7kPzFCOuXdcAJYAESMN/J/G1fuXvrAtfo69UBhfPBeLipDVN N2/2HGpnFwmYQ3VhivXItZ7YmPxzR1TOpy587X1w1gDD+FsTRYkx53ms8stiBqztfbcv gXf2T5NngrGUgOEr7+RSoZO0J77GPq5Nxd4OjDBf1TiB9ce6O2vbujnq4tKvsLrNowik InJ/VC7RYJNz0iwpagEwPwCH7fU7gln+2GDF1WwfqqBvgA9dh0HuLodXUoVjUidgMMUP kRcBbeB2prxwbKvU2q3RzGkgJ0oT0DP3OFOrLMoG2tOzuxGoYaBaKCVfz8+lBwcLEKJM zUMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781970798; x=1782575598; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=t3oRoBnDVYl3gPZelBeVqw/jUzlCT3WUncuxAr44dxE=; b=H5IgsK+Pf5FSKmTQfRE7ycTV3HG4mJqWw5RPppDjxbYC3QnYvEIpI8lr9WZiTm7ze9 K/zPuAIHX4VkzRff/L3a/X0hDncQ4sulIyLf+gYgJLDOEHrt/NBqRMTxlZkKSPyVS1+7 K9DqDgKtgPZM7yRTYoMObhkmj1Aq3ldIU19kMLe4ugQbaBkR9nxqL+s3I3REoa2CSBsa iLb+pwOBkDPDOjkLnHjibE9o/xiV2fVsGEdffhU37gvQ7mJNqU46lNMFBUh/bMVnvYNx OxSN8BofzE+YBLqirfM13J3lKic7sQ0Uh9VxnPVFrSVVOQi2BgDGUDkMgSj30tcCf3EF z5jA== X-Forwarded-Encrypted: i=1; AFNElJ+5qKWGRGwFFoyi2iRsApLjl9riXkyaZtb0TOC4rqLqXkglZNPKgOhXOv1vXm0DVVMT3p7BzpPZ6FsMGOQ=@vger.kernel.org X-Gm-Message-State: AOJu0YzSAAE3uZ6Jf0KSLR6eE4O7h6hsuBjJy367b2Bw9Abkfs+V2Gtm IlPdQitaccByZDw6KXggQsG4DIyJVtQhNw2gzmKenMXpXABbQdYiptaL X-Gm-Gg: AfdE7clqYt7UCH0ZASMrsVTkg04Vlwk9FvMYsG3JQjvTKDEtWxbK7XTSQmo7ZAdRJl0 +ne2MefHzGjBdHm3M3nIJRih2ftvwHrACZNIAFpRa/F3BmfZBAsFvbIzxSZjWBaD/7YmkpZofDj 3lGTGfPhOsy3BkoGeuFwdbBZDPaZKBeW3JiLi5/DT5J7foaS+WNzbSipx62+IP+XsxwzyKA3PRP YrYsQuHamUJvH2GjsYmQTzxKBUY+pwc9fhi5WfpexKObfN/lYApk+P81V2+YEmPJkzasPSHiAoh pmkNs/gBNj6c+hx60Pci5DMfg8SFxalqogRAO6X+1tIf+HEtymrOuvpP4oM/+X8+6pirMfVGeVi txz3+NJ0E12tY0HyGpQXqpv0HLfZZ8a9C5pxZOLAsUY+51taj3jqnugdaJ8zJXVq/5oCUz4atIG hBGb7OMdu5BjNUq5HUtftYa4Qwh/0cccT9 X-Received: by 2002:a05:6a00:4f84:b0:845:3260:50d1 with SMTP id d2e1a72fcca58-845561132a0mr8214887b3a.27.1781970798558; Sat, 20 Jun 2026 08:53:18 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:8e0e:956e:b09c:23cd]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84564d6c164sm2409500b3a.3.2026.06.20.08.53.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 20 Jun 2026 08:53:18 -0700 (PDT) From: Ruoyu Wang To: Koby Elbaz , Konstantin Sinyuk , Oded Gabbay , farah kassabri Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH] accel/habanalabs: publish signal handle after SOB setup Date: Sat, 20 Jun 2026 23:53:13 +0800 Message-ID: <20260620155313.79464-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit cs_ioctl_reserve_signals() makes the encapsulated signal handle visible in the context IDR before the SOB pointer and pre-reserve SOB value are set. Concurrent unreserve and wait paths dereference those fields after IDR lookup. Reserve the IDR slot with a NULL entry, initialize the handle including the SOB fields, and replace the slot with the handle only after the visible state is ready. Fixes: dadf17abb724 ("habanalabs: add support for encapsulated signals reservation") Signed-off-by: Ruoyu Wang --- .../habanalabs/common/command_submission.c | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/drivers/accel/habanalabs/common/command_submission.c b/drivers/accel/habanalabs/common/command_submission.c index ba4257bda77b..791fc01e24c5 100644 --- a/drivers/accel/habanalabs/common/command_submission.c +++ b/drivers/accel/habanalabs/common/command_submission.c @@ -2009,6 +2009,7 @@ static int cs_ioctl_reserve_signals(struct hl_fpriv *hpriv, struct hl_cs_encaps_sig_handle *handle; struct hl_encaps_signals_mgr *mgr; struct hl_hw_sob *hw_sob; + void *old; int hdl_id; int rc = 0; @@ -2045,13 +2046,19 @@ static int cs_ioctl_reserve_signals(struct hl_fpriv *hpriv, } handle->count = count; + handle->q_idx = q_idx; + handle->hdev = hdev; + handle->cs_seq = ULLONG_MAX; + kref_init(&handle->refcount); hl_ctx_get(hpriv->ctx); handle->ctx = hpriv->ctx; mgr = &hpriv->ctx->sig_mgr; spin_lock(&mgr->lock); - hdl_id = idr_alloc(&mgr->handles, handle, 1, 0, GFP_ATOMIC); + hdl_id = idr_alloc(&mgr->handles, NULL, 1, 0, GFP_ATOMIC); + if (hdl_id >= 0) + handle->id = hdl_id; spin_unlock(&mgr->lock); if (hdl_id < 0) { @@ -2060,11 +2067,6 @@ static int cs_ioctl_reserve_signals(struct hl_fpriv *hpriv, goto put_ctx; } - handle->id = hdl_id; - handle->q_idx = q_idx; - handle->hdev = hdev; - kref_init(&handle->refcount); - hdev->asic_funcs->hw_queues_lock(hdev); hw_sob = &prop->hw_sob[prop->curr_sob_offset]; @@ -2093,11 +2095,18 @@ static int cs_ioctl_reserve_signals(struct hl_fpriv *hpriv, */ handle->pre_sob_val = prop->next_sob_val - handle->count; - handle->cs_seq = ULLONG_MAX; - *signals_count = prop->next_sob_val; hdev->asic_funcs->hw_queues_unlock(hdev); + spin_lock(&mgr->lock); + old = idr_replace(&mgr->handles, handle, hdl_id); + spin_unlock(&mgr->lock); + + if (WARN_ON(IS_ERR(old))) { + rc = PTR_ERR(old); + goto remove_idr; + } + *sob_addr = handle->hw_sob->sob_addr; *handle_id = hdl_id;