Re: [PATCH 09/10] drm/ttm: support using drm_exec during eviction v4

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Critical] The drm_exec_lock_obj_report_dup helper fails to bypass the DRM_EXEC_IGNORE_DUPLICATES flag, causing premature unlocking and use-after-free of already-reserved buffers.
- [Medium] The trylock_only and no_wait_gpu flags are ignored when ctx->exec is set, forcing synchronous blocking locks during fast/non-blocking eviction passes.
--

commit 013bce350b89f0772194d9c2194cd802f5e36ff2
Author: Christian König <christian.koenig@amd.com>

drm/ttm: support using drm_exec during eviction v4

Allow specifying a drm_exec object in TTMs operation context which is
used to lock objects during eviction.

This allows to handle deadlocks much more gracefully and with that
avoid returning -ENOMEM on heavily contended domains.

> diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
> index a53b25e8c2967..96699532817c2 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo_util.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c

[ ... ]

> @@ -837,6 +838,8 @@ static bool ttm_lru_walk_trylock(struct ttm_bo_lru_cursor *curs,
>  	struct ttm_operation_ctx *ctx = curs->arg->ctx;
>  
>  	curs->needs_unlock = false;
> +	if (ctx->exec)
> +		return false;

[Severity: Medium]
Will this force a blocking lock during fast/non-blocking eviction passes?

By returning false unconditionally when ctx->exec is set, we bypass the
trylock here.

Later in __ttm_bo_lru_cursor_next(), the added !arg->ctx->exec check
prevents skipping the buffer, forcing a fall-through to
ttm_lru_walk_ticketlock() which performs a blocking lock. This seems to
ignore the trylock_only and no_wait_gpu flags.

>  	if (dma_resv_trylock(bo->base.resv)) {
>  		curs->needs_unlock = true;

[ ... ]

> @@ -857,7 +860,9 @@ static int ttm_lru_walk_ticketlock(struct ttm_bo_lru_cursor *curs,
>  	struct ttm_lru_walk_arg *arg = curs->arg;
>  	int ret;
>  
> -	if (arg->ctx->interruptible)
> +	if (arg->ctx->exec)
> +		ret = drm_exec_lock_obj_report_dup(arg->ctx->exec, &bo->base);
> +	else if (arg->ctx->interruptible)
>  		ret = dma_resv_lock_interruptible(bo->base.resv, arg->ticket);

[ ... ]

> @@ -937,12 +946,17 @@ static void ttm_bo_lru_cursor_cleanup_bo(struct ttm_bo_lru_cursor *curs)
>  {
>  	struct ttm_buffer_object *bo = curs->bo;
>  
> -	if (bo) {
> -		if (curs->needs_unlock)
> +	if (!bo)
> +		return;
> +
> +	if (curs->needs_unlock) {
> +		if (curs->arg->ctx->exec)
> +			drm_exec_unlock_obj(curs->arg->ctx->exec, &bo->base);

[Severity: Critical]
Can this cause a use-after-free for already-reserved buffers?

Looking at drm_exec_lock_obj_report_dup() used in ttm_lru_walk_ticketlock(),
it passes false for the always_report_duplicates parameter:

drivers/gpu/drm/drm_exec.c:drm_exec_lock_obj_report_dup() {
    return __drm_exec_lock_obj(exec, obj, false);
}

If DRM_EXEC_IGNORE_DUPLICATES is set, it returns 0 instead of -EALREADY for
duplicate locks. When this happens, ttm_lru_walk_ticketlock() will see
ret == 0 and set curs->needs_unlock = true.

Because of this, when ttm_bo_lru_cursor_cleanup_bo() runs, it sees
needs_unlock is true and calls drm_exec_unlock_obj() here, which unlocks
the object and drops its reference. This completely removes the buffer
from the caller's outer WW transaction.

> +		else
>  			dma_resv_unlock(bo->base.resv);
> -		ttm_bo_put(bo);
> -		curs->bo = NULL;
>  	}
> +	ttm_bo_put(bo);
> +	curs->bo = NULL;
>  }

[ ... ]

> @@ -1016,8 +1030,8 @@ __ttm_bo_lru_cursor_next(struct ttm_bo_lru_cursor *curs)
>  		if (ttm_lru_walk_trylock(curs, bo)) {
>  			bo_locked = true;
>  
> -		} else if (!arg->ticket || arg->ctx->no_wait_gpu ||
> -			   arg->trylock_only) {
> +		} else if ((!arg->ticket || arg->ctx->no_wait_gpu ||
> +			    arg->trylock_only) && !arg->ctx->exec) {
>  			spin_unlock(lru_lock);
>  			ttm_bo_put(bo);
>  			spin_lock(lru_lock);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703-ttm_2_drm_exec-v1-0-43685ac1286b@gmx.de?part=9