[PATCH 1/2] dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v2

[PATCH 1/2] dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v2

[Christian König]

The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference"
changed the check to test for the ops pointer instead of the signaled
bit to avoid a potential NULL dereference when the ops pointer has been
cleared.

The problem is now that the ops pointer is cleared only when neither the
release nor the wait callback is implemented and this isn't true for a lot
of dma_fence implementations yet. So those implementations lost the RCU
protection after signaling of the returned string resulting in potential
use after free.

Add the signaling check additional to the ops pointer check so that we
have both the protection against NULL dereference as well as the RCU
protection after signaling for the returned string.

v2: improve comments to note RCU protection and explain why we check
    both signaling state and ops pointer

Signed-off-by: Christian König <christian.koenig@amd.com>
Fixes: 035219a760ed ("dma-buf: dma-fence: Fix potential NULL pointer dereference")
CC: stable@vger.kernel.org # 7.2+
Reported-by: Jonghyuk Kim(MalHyuk) <malhyuk97@gmail.com>
Tested-by: Jonghyuk Kim(MalHyuk) <malhyuk97@gmail.com>
---
 drivers/dma-buf/dma-fence.c | 16 ++++++++++++++--
 include/linux/dma-fence.h   |  6 ++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c
index 05090fb0fd5ae..f52675f3ba03a 100644
--- a/drivers/dma-buf/dma-fence.c
+++ b/drivers/dma-buf/dma-fence.c
@@ -1170,7 +1170,13 @@ const char __rcu *dma_fence_driver_name(struct dma_fence *fence)
 
 	/* RCU protection is required for safe access to returned string */
 	ops = rcu_dereference(fence->ops);
-	if (ops)
+
+	/*
+	 * Check both signaled state and ops pointer, we don't know which one is
+	 * loaded first and ops pointer is only set to NULL on newer
+	 * implementations.
+	 */
+	if (!dma_fence_test_signaled_flag(fence) && ops)
 		return (const char __rcu *)ops->get_driver_name(fence);
 	else
 		return (const char __rcu *)"detached-driver";
@@ -1203,7 +1209,13 @@ const char __rcu *dma_fence_timeline_name(struct dma_fence *fence)
 
 	/* RCU protection is required for safe access to returned string */
 	ops = rcu_dereference(fence->ops);
-	if (ops)
+
+	/*
+	 * Check both signaled state and ops pointer, we don't know which one is
+	 * loaded first and ops pointer is only set to NULL on newer
+	 * implementations.
+	 */
+	if (!dma_fence_test_signaled_flag(fence) && ops)
 		return (const char __rcu *)ops->get_timeline_name(fence);
 	else
 		return (const char __rcu *)"signaled-timeline";
diff --git a/include/linux/dma-fence.h b/include/linux/dma-fence.h
index 158cd609f1036..ffa99b930843e 100644
--- a/include/linux/dma-fence.h
+++ b/include/linux/dma-fence.h
@@ -141,6 +141,9 @@ struct dma_fence_ops {
 	 * compute the name at runtime, without having it to store permanently
 	 * for each fence, or build a cache of some sort.
 	 *
+	 * The returned string is RCU protected and can be freed after the fence
+	 * signaled and a RCU grace period passed.
+	 *
 	 * This callback is mandatory.
 	 */
 	const char * (*get_driver_name)(struct dma_fence *fence);
@@ -153,6 +156,9 @@ struct dma_fence_ops {
 	 * having it to store permanently for each fence, or build a cache of
 	 * some sort.
 	 *
+	 * The returned string is RCU protected and can be freed after the fence
+	 * signaled and a RCU grace period passed.
+	 *
 	 * This callback is mandatory.
 	 */
 	const char * (*get_timeline_name)(struct dma_fence *fence);
-- 
2.43.0

[PATCH 2/2] drm/sched: document the RCU dependency

[Christian König]

Tvrkos patches added RCU protection to the returned strings from
get_timeline_name()/get_driver_name() callbacks of the dma_fence
backends.

This fixed use after free problems for a couple of drivers, but we never
documented the consequences for the drm_sched_fence.

Add a few words on the function documentation to note that we need an
RCU grace period between signaling the last scheduler fence and
scheduler teardown.

Signed-off-by: Christian König <christian.koenig@amd.com>
---
 drivers/gpu/drm/scheduler/sched_main.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
index 6cb6f95464938..f73c5141b4e5c 100644
--- a/drivers/gpu/drm/scheduler/sched_main.c
+++ b/drivers/gpu/drm/scheduler/sched_main.c
@@ -1203,6 +1203,11 @@ static void drm_sched_cancel_remaining_jobs(struct drm_gpu_scheduler *sched)
  * is implemented, all jobs will be canceled through it and afterwards cleaned
  * up through &struct drm_sched_backend_ops.free_job. If cancel_job is not
  * implemented, memory could leak.
+ *
+ * The user must wait one RCU grace period between signaling the last hardware-
+ * fence and calling this function because the timeline name returned by
+ * scheduler fences must stay valid until all readers have exited their RCU read
+ * side critical section.
  */
 void drm_sched_fini(struct drm_gpu_scheduler *sched)
 {
-- 
2.43.0

Re: [PATCH 2/2] drm/sched: document the RCU dependency

[Philipp Stanner]

On Mon, 2026-09-14 at 20:27 +0200, Christian König wrote:
> Tvrkos patches added RCU protection to the returned strings from

*Tvrtko ;)

Anyways, which patches? Better add a commit ID?

> get_timeline_name()/get_driver_name() callbacks of the dma_fence
> backends.
> 
> This fixed use after free problems for a couple of drivers, but we never
> documented the consequences for the drm_sched_fence.
> 
> Add a few words on the function documentation to note that we need an
> RCU grace period between signaling the last scheduler fence and

s/scheduler fence/hardware-fence

:D

> scheduler teardown.
> 
> Signed-off-by: Christian König <christian.koenig@amd.com>

with the above:

Acked-by: Philipp Stanner <phasta@kernel.org>

> ---
>  drivers/gpu/drm/scheduler/sched_main.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
> index 6cb6f95464938..f73c5141b4e5c 100644
> --- a/drivers/gpu/drm/scheduler/sched_main.c
> +++ b/drivers/gpu/drm/scheduler/sched_main.c
> @@ -1203,6 +1203,11 @@ static void drm_sched_cancel_remaining_jobs(struct drm_gpu_scheduler *sched)
>   * is implemented, all jobs will be canceled through it and afterwards cleaned
>   * up through &struct drm_sched_backend_ops.free_job. If cancel_job is not
>   * implemented, memory could leak.
> + *
> + * The user must wait one RCU grace period between signaling the last hardware-
> + * fence and calling this function because the timeline name returned by
> + * scheduler fences must stay valid until all readers have exited their RCU read
> + * side critical section.
>   */
>  void drm_sched_fini(struct drm_gpu_scheduler *sched)
>  {

Re: [PATCH 1/2] dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v2

[Philipp Stanner]

On Mon, 2026-09-14 at 20:27 +0200, Christian König wrote:
> The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference"
> changed the check to test for the ops pointer instead of the signaled
> bit to avoid a potential NULL dereference when the ops pointer has been
> cleared.
> 
> The problem is now that the ops pointer is cleared only when neither the
> release nor the wait callback is implemented and this isn't true for a lot
> of dma_fence implementations yet. So those implementations lost the RCU
> protection after signaling of the returned string resulting in potential
> use after free.
> 
> Add the signaling check additional to the ops pointer check so that we
> have both the protection against NULL dereference as well as the RCU
> protection after signaling for the returned string.
> 
> v2: improve comments to note RCU protection and explain why we check
>     both signaling state and ops pointer
> 
> Signed-off-by: Christian König <christian.koenig@amd.com>
> Fixes: 035219a760ed ("dma-buf: dma-fence: Fix potential NULL pointer dereference")
> CC: stable@vger.kernel.org # 7.2+
> Reported-by: Jonghyuk Kim(MalHyuk) <malhyuk97@gmail.com>
> Tested-by: Jonghyuk Kim(MalHyuk) <malhyuk97@gmail.com>

Reviewed-by: Philipp Stanner <phasta@kernel.org>

> ---
>  drivers/dma-buf/dma-fence.c | 16 ++++++++++++++--
>  include/linux/dma-fence.h   |  6 ++++++
>  2 files changed, 20 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c
> index 05090fb0fd5ae..f52675f3ba03a 100644
> --- a/drivers/dma-buf/dma-fence.c
> +++ b/drivers/dma-buf/dma-fence.c
> @@ -1170,7 +1170,13 @@ const char __rcu *dma_fence_driver_name(struct dma_fence *fence)
>  
>  	/* RCU protection is required for safe access to returned string */
>  	ops = rcu_dereference(fence->ops);
> -	if (ops)
> +
> +	/*
> +	 * Check both signaled state and ops pointer, we don't know which one is
> +	 * loaded first and ops pointer is only set to NULL on newer
> +	 * implementations.
> +	 */

nit: "we don't know" doesn't give the reader confidence that the
ordering is right. I would more say "Load ordering is irrelevant
because …".


P.