[PATCH] drm/sched: Remove useless BUG_ON()

[PATCH] drm/sched: Remove useless BUG_ON()

[Philipp Stanner]

BUG_ON() should not be used anymore since it crashes the entire kernel.
Its remaining usage is in drm_sched_job_arm() to check the entity
pointer. If that pointer is NULL, however, the problem will become
visible through a respective NULL pointer exception anyways.

There is no advantage in crashing the kernel as a whole.

Remove the BUG_ON().

Signed-off-by: Philipp Stanner <phasta@kernel.org>
---
 drivers/gpu/drm/scheduler/sched_main.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
index d2ca01b31ee4..4e1b6e79ae19 100644
--- a/drivers/gpu/drm/scheduler/sched_main.c
+++ b/drivers/gpu/drm/scheduler/sched_main.c
@@ -637,7 +637,6 @@ void drm_sched_job_arm(struct drm_sched_job *job)
 	struct drm_gpu_scheduler *sched;
 	struct drm_sched_entity *entity = job->entity;
 
-	BUG_ON(!entity);
 	drm_sched_entity_select_rq(entity);
 	sched = container_of(entity->rq, typeof(*sched), rq);
 
-- 
2.54.0

Re: [PATCH] drm/sched: Remove useless BUG_ON()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Invalid pointer calculation and subsequent dereference when no schedulers are ready.
--

commit 9f3c42b74323f1ffa6b677518014a9ecac0a6163
Author: Philipp Stanner <phasta@kernel.org>

drm/sched: Remove useless BUG_ON()

This commit removes a BUG_ON() in drm_sched_job_arm() that checks for a NULL
entity pointer, reasoning that a NULL pointer exception will happen anyway
and it is better not to explicitly crash the entire kernel.

> diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
> index 818d3d4434b57..da9210632d81e 100644
> --- a/drivers/gpu/drm/scheduler/sched_main.c
> +++ b/drivers/gpu/drm/scheduler/sched_main.c
> @@ -646,7 +646,6 @@ void drm_sched_job_arm(struct drm_sched_job *job)
>  	struct drm_gpu_scheduler *sched;
>  	struct drm_sched_entity *entity = job->entity;
>  
> -	BUG_ON(!entity);
>  	drm_sched_entity_select_rq(entity);
>  	sched = container_of(entity->rq, typeof(*sched), rq);

[Severity: High]
This is a pre-existing issue, but can this container_of() produce a negative
pointer if all schedulers are not ready?

If an entity has multiple schedulers and all of them have ready == false (for
example, during a GPU reset), drm_sched_pick_best() returns NULL:

drm_sched_entity_select_rq() {
	...
	sched = drm_sched_pick_best(entity->sched_list, entity->num_sched_list);
	rq = sched ? &sched->rq : NULL;
	if (rq != entity->rq) {
		drm_sched_rq_remove_entity(entity->rq, entity);
		entity->rq = rq;
	}
	...
}

When drm_sched_entity_select_rq() returns, entity->rq is NULL. Back in
drm_sched_job_arm(), the container_of() calculation yields an invalid negative
pointer because rq is not at offset 0 of struct drm_gpu_scheduler.

Later, when drm_sched_entity_push_job() is called, it recomputes this negative
pointer and dereferences it, causing an immediate page fault:

drm_sched_entity_push_job() {
	...
	struct drm_gpu_scheduler *sched =
		container_of(entity->rq, typeof(*sched), rq);
	...
	atomic_inc(sched->score);
	...
}

Is there a way to safely handle the case where no schedulers are ready here?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260625120151.1757146-2-phasta@kernel.org?part=1