mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Philipp Stanner <phasta@mailbox.org>
To: phasta@kernel.org, "Tvrtko Ursulin" <tursulin@ursulin.net>,
	"Christian König" <christian.koenig@amd.com>,
	"Jonghyuk Kim(MalHyuk)" <malhyuk97@gmail.com>,
	matthew.brost@intel.com, dakr@kernel.org
Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
	 mdaenzer@redhat.com, alessio.belle@imgtec.com,
	luigi.santivetti@imgtec.com, stable@vger.kernel.org
Subject: Re: [PATCH v4 1/3] drm/sched: cache the timeline name to fix a use-after-free
Date: Mon, 07 Sep 2026 11:49:56 +0200	[thread overview]
Message-ID: <b36f5adfd5f6243d79e321e99b29b932a270f551.camel@mailbox.org> (raw)
In-Reply-To: <d3d2ae0ae55fb07780f643de9517f3668484575a.camel@mailbox.org>

On Mon, 2026-09-07 at 11:42 +0200, Philipp Stanner wrote:
> Moreover, even if we did remove ops->release in drm_sched, it would
> still be a race: a driver's contract is the hardware_fence, the rule
> being that you have to signal those. So after signaling the last
> hardware_fence, you could actually start releasing resources, but it
> might be that finished_fences are still in-flight and are unsignaled.
> 
> So we have some sort of fence -> fence race here, too.

Forget about that, signaling the hw_fence should always result in
undelayed signaling of the finished-fence.

So it would seem that making the signaled-state instead of ops == NULL
the decoupling point in dma_fence is the solution to go for?


P.

  reply	other threads:[~2026-09-07  9:50 UTC|newest]

Thread overview: 34+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-04  8:06 [PATCH v4 0/3] drm/sched: fix use-after-free of the fence timeline name Jonghyuk Kim(MalHyuk)
2026-09-04  8:06 ` [PATCH v4 1/3] drm/sched: cache the timeline name to fix a use-after-free Jonghyuk Kim(MalHyuk)
2026-09-04  8:20   ` Christian König
2026-09-04  8:31     ` Philipp Stanner
2026-09-04 12:49       ` Christian König
2026-09-04 19:06         ` Philipp Stanner
2026-09-07  9:15           ` Tvrtko Ursulin
2026-09-07  9:42             ` Philipp Stanner
2026-09-07  9:49               ` Philipp Stanner [this message]
2026-09-07 10:28               ` Tvrtko Ursulin
2026-09-07 10:34                 ` Tvrtko Ursulin
2026-09-07 10:47                 ` Philipp Stanner
2026-09-07 11:06                   ` Tvrtko Ursulin
2026-09-07 11:15                     ` Philipp Stanner
2026-09-07 12:59                       ` Christian König
2026-09-07 13:38                         ` Philipp Stanner
2026-09-07 15:21                           ` Christian König
2026-09-08 10:49                             ` Jonghyuk Kim(MalHyuk)
2026-09-08 11:07                               ` Philipp Stanner
2026-09-09  0:37                                 ` Jonghyuk Kim(MalHyuk)
2026-09-09  7:44                                   ` Philipp Stanner
2026-09-07 12:28                     ` Tvrtko Ursulin
2026-09-08 15:20                       ` Tvrtko Ursulin
2026-09-07 12:18               ` Alessio Belle
2026-09-07 11:42           ` Christian König
2026-09-07 11:54             ` Philipp Stanner
2026-09-04  8:31     ` Jonghyuk Kim(MalHyuk)
2026-09-04  8:39       ` Philipp Stanner
2026-09-04  9:11         ` Jonghyuk Kim(MalHyuk)
2026-09-04  9:07       ` Tvrtko Ursulin
2026-09-04  9:57   ` Danilo Krummrich
2026-09-04 10:51     ` Philipp Stanner
2026-09-04  8:06 ` [PATCH v4 2/3] drm/sched: add the fence ops-detach cleanup to the TODO list Jonghyuk Kim(MalHyuk)
2026-09-04  8:06 ` [PATCH v4 3/3] drm/sched/tests: add a UAF regression test for the timeline name Jonghyuk Kim(MalHyuk)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=b36f5adfd5f6243d79e321e99b29b932a270f551.camel@mailbox.org \
    --to=phasta@mailbox.org \
    --cc=alessio.belle@imgtec.com \
    --cc=christian.koenig@amd.com \
    --cc=dakr@kernel.org \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luigi.santivetti@imgtec.com \
    --cc=malhyuk97@gmail.com \
    --cc=matthew.brost@intel.com \
    --cc=mdaenzer@redhat.com \
    --cc=phasta@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tursulin@ursulin.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®