Re: [PATCH] drm/sched: Remove useless BUG_ON()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Invalid pointer calculation and subsequent dereference when no schedulers are ready.
--

commit 9f3c42b74323f1ffa6b677518014a9ecac0a6163
Author: Philipp Stanner <phasta@kernel.org>

drm/sched: Remove useless BUG_ON()

This commit removes a BUG_ON() in drm_sched_job_arm() that checks for a NULL
entity pointer, reasoning that a NULL pointer exception will happen anyway
and it is better not to explicitly crash the entire kernel.

> diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
> index 818d3d4434b57..da9210632d81e 100644
> --- a/drivers/gpu/drm/scheduler/sched_main.c
> +++ b/drivers/gpu/drm/scheduler/sched_main.c
> @@ -646,7 +646,6 @@ void drm_sched_job_arm(struct drm_sched_job *job)
>  	struct drm_gpu_scheduler *sched;
>  	struct drm_sched_entity *entity = job->entity;
>  
> -	BUG_ON(!entity);
>  	drm_sched_entity_select_rq(entity);
>  	sched = container_of(entity->rq, typeof(*sched), rq);

[Severity: High]
This is a pre-existing issue, but can this container_of() produce a negative
pointer if all schedulers are not ready?

If an entity has multiple schedulers and all of them have ready == false (for
example, during a GPU reset), drm_sched_pick_best() returns NULL:

drm_sched_entity_select_rq() {
	...
	sched = drm_sched_pick_best(entity->sched_list, entity->num_sched_list);
	rq = sched ? &sched->rq : NULL;
	if (rq != entity->rq) {
		drm_sched_rq_remove_entity(entity->rq, entity);
		entity->rq = rq;
	}
	...
}

When drm_sched_entity_select_rq() returns, entity->rq is NULL. Back in
drm_sched_job_arm(), the container_of() calculation yields an invalid negative
pointer because rq is not at offset 0 of struct drm_gpu_scheduler.

Later, when drm_sched_entity_push_job() is called, it recomputes this negative
pointer and dereferences it, causing an immediate page fault:

drm_sched_entity_push_job() {
	...
	struct drm_gpu_scheduler *sched =
		container_of(entity->rq, typeof(*sched), rq);
	...
	atomic_inc(sched->score);
	...
}

Is there a way to safely handle the case where no schedulers are ready here?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260625120151.1757146-2-phasta@kernel.org?part=1