From: Philipp Stanner <phasta@mailbox.org>
To: "Christian König" <christian.koenig@amd.com>,
phasta@kernel.org, "Tvrtko Ursulin" <tursulin@ursulin.net>,
"Jonghyuk Kim(MalHyuk)" <malhyuk97@gmail.com>,
matthew.brost@intel.com, dakr@kernel.org
Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
mdaenzer@redhat.com, alessio.belle@imgtec.com,
luigi.santivetti@imgtec.com, stable@vger.kernel.org
Subject: Re: [PATCH v4 1/3] drm/sched: cache the timeline name to fix a use-after-free
Date: Mon, 07 Sep 2026 15:38:46 +0200 [thread overview]
Message-ID: <299ef4389875fe1333bb934edcece3bee5c5526b.camel@mailbox.org> (raw)
In-Reply-To: <fa12360b-2ccf-41c4-a158-84e34835c0e9@amd.com>
On Mon, 2026-09-07 at 14:59 +0200, Christian König wrote:
> I think the memory ordering isn't really a problem.
>
> See if the ops pointer or the signaled bit is loaded first doesn't
> matter if you check both.
>
> You only need to make sure that the ops pointer is loaded once cause
> that one is used multiple times, but that is already the case by
> using rcu_dereference().
That.. sounds correct.
Although I still don't get why we then can't use the signaled state
everywhere instead of the ops pointer. That would be simpler.
Anyways.
Maybe Jonghyuk can give your patch a test run and then we could use it
as a hot-fix to backport and discuss the wider future of dma-fence
separately?
P.
next prev parent reply other threads:[~2026-09-07 13:38 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-04 8:06 [PATCH v4 0/3] drm/sched: fix use-after-free of the fence timeline name Jonghyuk Kim(MalHyuk)
2026-09-04 8:06 ` [PATCH v4 1/3] drm/sched: cache the timeline name to fix a use-after-free Jonghyuk Kim(MalHyuk)
2026-09-04 8:18 ` sashiko-bot
2026-09-04 8:20 ` Christian König
2026-09-04 8:31 ` Philipp Stanner
2026-09-04 12:49 ` Christian König
2026-09-04 19:06 ` Philipp Stanner
2026-09-07 9:15 ` Tvrtko Ursulin
2026-09-07 9:42 ` Philipp Stanner
2026-09-07 9:49 ` Philipp Stanner
2026-09-07 10:28 ` Tvrtko Ursulin
2026-09-07 10:34 ` Tvrtko Ursulin
2026-09-07 10:47 ` Philipp Stanner
2026-09-07 11:06 ` Tvrtko Ursulin
2026-09-07 11:15 ` Philipp Stanner
2026-09-07 12:59 ` Christian König
2026-09-07 13:38 ` Philipp Stanner [this message]
2026-09-07 15:21 ` Christian König
2026-09-08 10:49 ` Jonghyuk Kim(MalHyuk)
2026-09-08 11:07 ` Philipp Stanner
2026-09-09 0:37 ` Jonghyuk Kim(MalHyuk)
2026-09-09 7:44 ` Philipp Stanner
2026-09-07 12:28 ` Tvrtko Ursulin
2026-09-08 15:20 ` Tvrtko Ursulin
2026-09-07 12:18 ` Alessio Belle
2026-09-07 11:42 ` Christian König
2026-09-07 11:54 ` Philipp Stanner
2026-09-04 8:31 ` Jonghyuk Kim(MalHyuk)
2026-09-04 8:39 ` Philipp Stanner
2026-09-04 9:11 ` Jonghyuk Kim(MalHyuk)
2026-09-04 9:07 ` Tvrtko Ursulin
2026-09-04 9:57 ` Danilo Krummrich
2026-09-04 10:51 ` Philipp Stanner
2026-09-04 8:06 ` [PATCH v4 2/3] drm/sched: add the fence ops-detach cleanup to the TODO list Jonghyuk Kim(MalHyuk)
2026-09-04 8:06 ` [PATCH v4 3/3] drm/sched/tests: add a UAF regression test for the timeline name Jonghyuk Kim(MalHyuk)
2026-09-04 8:15 ` sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=299ef4389875fe1333bb934edcece3bee5c5526b.camel@mailbox.org \
--to=phasta@mailbox.org \
--cc=alessio.belle@imgtec.com \
--cc=christian.koenig@amd.com \
--cc=dakr@kernel.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luigi.santivetti@imgtec.com \
--cc=malhyuk97@gmail.com \
--cc=matthew.brost@intel.com \
--cc=mdaenzer@redhat.com \
--cc=phasta@kernel.org \
--cc=stable@vger.kernel.org \
--cc=tursulin@ursulin.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.