From: "Christian König" <christian.koenig@amd.com>
To: phasta@kernel.org, malhyuk97@gmail.com, tursulin@ursulin.net,
matthew.brost@intel.com, dakr@kernel.org
Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
mdaenzer@redhat.com, alessio.belle@imgtec.com,
luigi.santivetti@imgtec.com
Subject: Re: [PATCH 2/2] drm/sched: document the RCU dependency
Date: Wed, 9 Sep 2026 15:57:08 +0200 [thread overview]
Message-ID: <5cfbf5d7-8729-4924-8ed6-eabfb53600cb@amd.com> (raw)
In-Reply-To: <9dedaa001c468be2afaf6ab19cd4f8cd96d0a8c7.camel@mailbox.org>
On 9/9/26 15:55, Philipp Stanner wrote:
> On Wed, 2026-09-09 at 15:14 +0200, Christian König wrote:
>> Tvrkos patches added RCU protection to the returned strings from
>> get_timeline_name()/get_driver_name() callbacks of the dma_fence
>> backends.
>>
>> This fixed use after free problems for a couple of drivers, but we never
>> documented the consequences for the drm_sched_fence.
>>
>> Add a few words on the function documentation to note that we need an
>> RCU grace period between signaling the last scheduler fence and
>> scheduler teardown.
>>
>> Signed-off-by: Christian König <christian.koenig@amd.com>
>> ---
>> drivers/gpu/drm/scheduler/sched_main.c | 4 ++++
>> 1 file changed, 4 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
>> index 6cb6f9546493..22103cb07782 100644
>> --- a/drivers/gpu/drm/scheduler/sched_main.c
>> +++ b/drivers/gpu/drm/scheduler/sched_main.c
>> @@ -1203,6 +1203,10 @@ static void drm_sched_cancel_remaining_jobs(struct drm_gpu_scheduler *sched)
>> * is implemented, all jobs will be canceled through it and afterwards cleaned
>> * up through &struct drm_sched_backend_ops.free_job. If cancel_job is not
>> * implemented, memory could leak.
>> + *
>> + * The scheduler fences timeline name is returned protected by the signaled
>> + * status and RCU, so an RCU grace period is necessary between signaling the
>> + * last scheduler fence and tearing down the scheduler who originated it.
>> */
>
> The API user does not signal a "scheduler fence", typically. Are you
> referring to the hardware-fence?
Yes, of course. Signaling the HW fence then causes the scheduler fence to signal as well.
>
> The user must signal all hardware-fences, which will cause all
> finished-fences (which are at the root of the addressed problem) to be
> signaled.
>
> So what you probably want to say is "The user must wait one RCU grace
> period between signaling the last hardware-fence and calling this
> function because …".
k, going to fix that.
Thanks,
Christian.
>
>
> P.
prev parent reply other threads:[~2026-09-09 13:57 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-09 13:14 Fix dma_fence use after free regression Christian König
2026-09-09 13:14 ` [PATCH 1/2] dma-buf/dma-fence: fix checking signaling bit for timeline and driver name Christian König
2026-09-09 13:58 ` Philipp Stanner
2026-09-09 13:14 ` [PATCH 2/2] drm/sched: document the RCU dependency Christian König
2026-09-09 13:55 ` Philipp Stanner
2026-09-09 13:57 ` Christian König [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5cfbf5d7-8729-4924-8ed6-eabfb53600cb@amd.com \
--to=christian.koenig@amd.com \
--cc=alessio.belle@imgtec.com \
--cc=dakr@kernel.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luigi.santivetti@imgtec.com \
--cc=malhyuk97@gmail.com \
--cc=matthew.brost@intel.com \
--cc=mdaenzer@redhat.com \
--cc=phasta@kernel.org \
--cc=tursulin@ursulin.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®