• Yintian Tao's avatar
    drm/scheduler: fix rare NULL ptr race · 3c0fdf33
    Yintian Tao authored
    There is one one corner case at dma_fence_signal_locked
    which will raise the NULL pointer problem just like below.
    ->dma_fence_signal
        ->dma_fence_signal_locked
    	->test_and_set_bit
    here trigger dma_fence_release happen due to the zero of fence refcount.
    
    ->dma_fence_put
        ->dma_fence_release
    	->drm_sched_fence_release_scheduled
    	    ->call_rcu
    here make the union fled “cb_list” at finished fence
    to NULL because struct rcu_head contains two pointer
    which is same as struct list_head cb_list
    
    Therefore, to hold the reference of finished fence at drm_sched_process_job
    to prevent the null pointer during finished fence dma_fence_signal
    
    [  732.912867] BUG: kernel NULL pointer dereference, address: 0000000000000008
    [  732.914815] #PF: supervisor write access in kernel mode
    [  732.915731] #PF: error_code(0x0002) - not-present page
    [  732.916621] PGD 0 P4D 0
    [  732.917072] Oops: 0002 [#1] SMP PTI
    [  732.917682] CPU: 7 PID: 0 Comm: swapper/7 Tainted: G           OE     5.4.0-rc7 #1
    [  732.918980] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
    [  732.920906] RIP: 0010:dma_fence_signal_locked+0x3e/0x100
    [  732.938569] Call Trace:
    [  732.939003]  <IRQ>
    [  732.939364]  dma_fence_signal+0x29/0x50
    [  732.940036]  drm_sched_fence_finished+0x12/0x20 [gpu_sched]
    [  732.940996]  drm_sched_process_job+0x34/0xa0 [gpu_sched]
    [  732.941910]  dma_fence_signal_locked+0x85/0x100
    [  732.942692]  dma_fence_signal+0x29/0x50
    [  732.943457]  amdgpu_fence_process+0x99/0x120 [amdgpu]
    [  732.944393]  sdma_v4_0_process_trap_irq+0x81/0xa0 [amdgpu]
    
    v2: hold the finished fence at drm_sched_process_job instead of
        amdgpu_fence_process
    v3: resume the blank line
    Signed-off-by: default avatarYintian Tao <yttao@amd.com>
    Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
    Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
    3c0fdf33
sched_main.c 23.1 KB