Attachment 120274 Details for Bug 93079 – 0001-drm-amdgpu-fix-race-condition-in-amd_sched_entity_pu.patch

[patch] 0001-drm-amdgpu-fix-race-condition-in-amd_sched_entity_pu.patch

0001-drm-amdgpu-fix-race-condition-in-amd_sched_entity_pu.patch (text/plain), 2.11 KB, created by Nicolai Hähnle on 2015-12-02 13:18:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nicolai Hähnle

Created: 2015-12-02 13:18:22 UTC

Size: 2.11 KB

patch

obsolete

>From 4480e081b60fba33f388a551bd97234d29d42cc3 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Nicolai=20H=C3=A4hnle?= <nicolai.haehnle@amd.com>
>Date: Wed, 2 Dec 2015 13:28:25 +0100
>Subject: [PATCH] drm/amdgpu: fix race condition in amd_sched_entity_push_job
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>As soon as we leave the spinlock after the job has been added to the job
>queue, we can no longer rely on the job's data to be available.
>
>I have seen a null-pointer dereference due to sched == NULL in
>amd_sched_wakeup via amd_sched_entity_push_job and
>amd_sched_ib_submit_kernel_helper. Since the latter initializes
>sched_job->sched with the address of the ring scheduler, which is
>guaranteed to be non-NULL, this race appears to be a likely culprit.
>
>Signed-off-by: Nicolai HÃ¤hnle <nicolai.haehnle@amd.com>
>Bugzilla: https://bugs.freedesktop.org/attachment.cgi?bugid=93079
>Reviewed-by: Christian KÃ¶nig <christian.koenig@amd.com>
>---
> drivers/gpu/drm/amd/scheduler/gpu_scheduler.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
>diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
>index e13b7a0..5ace1a7 100644
>--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
>+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
>@@ -288,6 +288,7 @@ amd_sched_entity_pop_job(struct amd_sched_entity *entity)
>  */
> static bool amd_sched_entity_in(struct amd_sched_job *sched_job)
> {
>+	struct amd_gpu_scheduler *sched = sched_job->sched;
> 	struct amd_sched_entity *entity = sched_job->s_entity;
> 	bool added, first = false;
> 
>@@ -302,7 +303,7 @@ static bool amd_sched_entity_in(struct amd_sched_job *sched_job)
> 
> 	/* first job wakes up scheduler */
> 	if (first)
>-		amd_sched_wakeup(sched_job->sched);
>+		amd_sched_wakeup(sched);
> 
> 	return added;
> }
>@@ -318,9 +319,9 @@ void amd_sched_entity_push_job(struct amd_sched_job *sched_job)
> {
> 	struct amd_sched_entity *entity = sched_job->s_entity;
> 
>+	trace_amd_sched_job(sched_job);
> 	wait_event(entity->sched->job_scheduled,
> 		   amd_sched_entity_in(sched_job));
>-	trace_amd_sched_job(sched_job);
> }
> 
> /**
>-- 
>2.5.0
>

Actions: View | Splinter Review

Attachments on bug 93079: 120050 | 120051 | 120106 | 120274

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.