[PATCH] drm/nouveau: Fix race in nouveau_sched_fini()

[PATCH] drm/nouveau: Fix race in nouveau_sched_fini()

[Philipp Stanner]

nouveau_sched_fini() uses a memory barrier before wait_event().
wait_event(), however, is a macro which expands to a loop which might
check the passed condition several times. The barrier would only take
effect for the first check.

Replace the barrier with a function which takes the spinlock.

Cc: stable@vger.kernel.org # v6.8+
Fixes: 5f03a507b29e ("drm/nouveau: implement 1:1 scheduler - entity relationship")
Signed-off-by: Philipp Stanner <phasta@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_sched.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_sched.c b/drivers/gpu/drm/nouveau/nouveau_sched.c
index e60f7892f5ce..a7bf539e5d86 100644
--- a/drivers/gpu/drm/nouveau/nouveau_sched.c
+++ b/drivers/gpu/drm/nouveau/nouveau_sched.c
@@ -482,6 +482,17 @@ nouveau_sched_create(struct nouveau_sched **psched, struct nouveau_drm *drm,
 	return 0;
 }
 
+static bool
+nouveau_sched_job_list_empty(struct nouveau_sched *sched)
+{
+	bool empty;
+
+	spin_lock(&sched->job.list.lock);
+	empty = list_empty(&sched->job.list.head);
+	spin_unlock(&sched->job.list.lock);
+
+	return empty;
+}
 
 static void
 nouveau_sched_fini(struct nouveau_sched *sched)
@@ -489,8 +500,7 @@ nouveau_sched_fini(struct nouveau_sched *sched)
 	struct drm_gpu_scheduler *drm_sched = &sched->base;
 	struct drm_sched_entity *entity = &sched->entity;
 
-	rmb(); /* for list_empty to work without lock */
-	wait_event(sched->job.wq, list_empty(&sched->job.list.head));
+	wait_event(sched->job.wq, nouveau_sched_job_list_empty(sched));
 
 	drm_sched_entity_fini(entity);
 	drm_sched_fini(drm_sched);
-- 
2.49.0

Re: [PATCH] drm/nouveau: Fix race in nouveau_sched_fini()

[Danilo Krummrich]

On 10/24/25 6:12 PM, Philipp Stanner wrote:
> nouveau_sched_fini() uses a memory barrier before wait_event().
> wait_event(), however, is a macro which expands to a loop which might
> check the passed condition several times. The barrier would only take
> effect for the first check.
> 
> Replace the barrier with a function which takes the spinlock.
> 
> Cc: stable@vger.kernel.org # v6.8+
> Fixes: 5f03a507b29e ("drm/nouveau: implement 1:1 scheduler - entity relationship")
> Signed-off-by: Philipp Stanner <phasta@kernel.org>

Acked-by: Danilo Krummrich <dakr@kernel.org>

Re: [PATCH] drm/nouveau: Fix race in nouveau_sched_fini()

[Philipp Stanner]

On Fri, 2025-10-24 at 18:17 +0200, Danilo Krummrich wrote:
> On 10/24/25 6:12 PM, Philipp Stanner wrote:
> > nouveau_sched_fini() uses a memory barrier before wait_event().
> > wait_event(), however, is a macro which expands to a loop which might
> > check the passed condition several times. The barrier would only take
> > effect for the first check.
> > 
> > Replace the barrier with a function which takes the spinlock.
> > 
> > Cc: stable@vger.kernel.org # v6.8+
> > Fixes: 5f03a507b29e ("drm/nouveau: implement 1:1 scheduler - entity relationship")
> > Signed-off-by: Philipp Stanner <phasta@kernel.org>
> 
> Acked-by: Danilo Krummrich <dakr@kernel.org>

Applied to drm-misc-fixes


P.