[PATCH v2] dma-buf/dma-fence: Mark two callbacks as deprecated

[PATCH v2] dma-buf/dma-fence: Mark two callbacks as deprecated

[Philipp Stanner]

dma_fence's backend_ops functions ops->wait() and ops->release() are
problematic because they prevent fence producers from unloading.
Moreover, they can easily be implemented through simpler means more
aligned with the dma_fence contract.

Since the declared goal of dma_fence is to move towards an
implementation that supports driver-unload in all circumstances, we must
prevent more parties from implementing those callbacks.

Deprecate ops->release() and ops->wait() and document what users should
do instead.

Signed-off-by: Philipp Stanner <phasta@kernel.org>
---
Changes in v2:
  - Drop confusing sentence (Christian).
---
 include/linux/dma-fence.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/linux/dma-fence.h b/include/linux/dma-fence.h
index dd07d128adc3..388c07d11e70 100644
--- a/include/linux/dma-fence.h
+++ b/include/linux/dma-fence.h
@@ -220,6 +220,8 @@ struct dma_fence_ops {
 	/**
 	 * @wait:
 	 *
+	 * DEPRECATED!
+	 *
 	 * Custom wait implementation, defaults to dma_fence_default_wait() if
 	 * not set.
 	 *
@@ -243,6 +245,8 @@ struct dma_fence_ops {
 	/**
 	 * @release:
 	 *
+	 * DEPRECATED!
+	 *
 	 * Called on destruction of fence to release additional resources.
 	 * Can be called from irq context.  This callback is optional. If it is
 	 * NULL, then dma_fence_free() is instead called as the default
@@ -254,6 +258,12 @@ struct dma_fence_ops {
 	 *
 	 * If the callback is implemented the memory backing the dma_fence
 	 * object must be freed RCU safe.
+	 *
+	 * Deprecated because it prevents the producer of a fence from
+	 * unloading. No new users must be implemented. Parties with a
+	 * hypothetical need for this callback can instead simply and directly
+	 * perform their custom release operations one RCU grace period after
+	 * they have signaled the fence.
 	 */
 	void (*release)(struct dma_fence *fence);
 

base-commit: 3e32932d3626d0279f9b3531bd648f8c0a16cb08
-- 
2.55.0

Re: [PATCH v2] dma-buf/dma-fence: Mark two callbacks as deprecated

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] dma-fence: @release deprecation advice causes UAF/SLAB corruption for embedded fences
- [Low] dma-fence: Missing @wait callback alternative documentation
--

commit 491d04795e6f38b069b06a9246cd098fdc0a8b55
Author: Philipp Stanner <phasta@kernel.org>

dma-buf/dma-fence: Mark two callbacks as deprecated

This commit marks the ops->wait() and ops->release() callbacks in
dma_fence_ops as deprecated. It updates the documentation to advise against
implementing them, aiming to move towards a design that supports driver
unloading in all circumstances.

> diff --git a/include/linux/dma-fence.h b/include/linux/dma-fence.h
> index dd07d128adc3b..388c07d11e708 100644
> --- a/include/linux/dma-fence.h
> +++ b/include/linux/dma-fence.h
> @@ -220,6 +220,8 @@ struct dma_fence_ops {
>  	/**
>  	 * @wait:
>  	 *
> +	 * DEPRECATED!
> +	 *
>  	 * Custom wait implementation, defaults to dma_fence_default_wait() if
>  	 * not set.

[Severity: Low]
The commit message indicates it will "document what users should do instead"
for both ops->release() and ops->wait(). However, while instructions are
provided for @release, the alternative implementation details for @wait seem
to be missing here.

Could documentation be added to explain what developers should use instead
of the @wait callback?

[ ... ]

> @@ -243,6 +245,8 @@ struct dma_fence_ops {
>  	/**
>  	 * @release:
>  	 *
> +	 * DEPRECATED!
> +	 *
>  	 * Called on destruction of fence to release additional resources.

[ ... ]

>  	 * If the callback is implemented the memory backing the dma_fence
>  	 * object must be freed RCU safe.
> +	 *
> +	 * Deprecated because it prevents the producer of a fence from
> +	 * unloading. No new users must be implemented. Parties with a
> +	 * hypothetical need for this callback can instead simply and directly
> +	 * perform their custom release operations one RCU grace period after
> +	 * they have signaled the fence.
>  	 */
>  	void (*release)(struct dma_fence *fence);

[Severity: High]
Does this advice correctly account for embedded dma_fence objects?

If a driver embeds struct dma_fence inside a driver-specific container,
removes its .release callback to comply with this documentation, and frees
the container one RCU grace period after signaling, could this cause a
use-after-free for consumers still holding a long-term reference like
dma_resv?

Alternatively, if a driver simply omits .release to follow the "no new
users" guidance without changing its allocation strategy, the core will
execute dma_fence_free() on the final dma_fence_put(). This fallback
executes kfree_rcu() directly on the fence pointer. If the fence is
embedded and not placed at offset 0, passing an interior pointer to
kfree_rcu() can corrupt the SLAB allocator.

Would it make sense to update the documentation to explicitly warn that
omitting .release requires the dma_fence to either be a standalone
allocation or placed at offset 0 within its container?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012171939.390365-2-phasta@kernel.org?part=1

Re: [PATCH v2] dma-buf/dma-fence: Mark two callbacks as deprecated

[Christian König]

On 10/12/26 19:19, Philipp Stanner wrote:
> dma_fence's backend_ops functions ops->wait() and ops->release() are
> problematic because they prevent fence producers from unloading.
> Moreover, they can easily be implemented through simpler means more
> aligned with the dma_fence contract.
> 
> Since the declared goal of dma_fence is to move towards an
> implementation that supports driver-unload in all circumstances, we must
> prevent more parties from implementing those callbacks.
> 
> Deprecate ops->release() and ops->wait() and document what users should
> do instead.
> 
> Signed-off-by: Philipp Stanner <phasta@kernel.org>

Reviewed-by: Christian König <christian.koenig@amd.com>

Going to push it to drm-misc-next later today.

> ---
> Changes in v2:
>   - Drop confusing sentence (Christian).
> ---
>  include/linux/dma-fence.h | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/include/linux/dma-fence.h b/include/linux/dma-fence.h
> index dd07d128adc3..388c07d11e70 100644
> --- a/include/linux/dma-fence.h
> +++ b/include/linux/dma-fence.h
> @@ -220,6 +220,8 @@ struct dma_fence_ops {
>  	/**
>  	 * @wait:
>  	 *
> +	 * DEPRECATED!
> +	 *
>  	 * Custom wait implementation, defaults to dma_fence_default_wait() if
>  	 * not set.
>  	 *
> @@ -243,6 +245,8 @@ struct dma_fence_ops {
>  	/**
>  	 * @release:
>  	 *
> +	 * DEPRECATED!
> +	 *
>  	 * Called on destruction of fence to release additional resources.
>  	 * Can be called from irq context.  This callback is optional. If it is
>  	 * NULL, then dma_fence_free() is instead called as the default
> @@ -254,6 +258,12 @@ struct dma_fence_ops {
>  	 *
>  	 * If the callback is implemented the memory backing the dma_fence
>  	 * object must be freed RCU safe.
> +	 *
> +	 * Deprecated because it prevents the producer of a fence from
> +	 * unloading. No new users must be implemented. Parties with a
> +	 * hypothetical need for this callback can instead simply and directly
> +	 * perform their custom release operations one RCU grace period after
> +	 * they have signaled the fence.
>  	 */
>  	void (*release)(struct dma_fence *fence);
>  
> 
> base-commit: 3e32932d3626d0279f9b3531bd648f8c0a16cb08