Fix dma_fence use after free regression

Fix dma_fence use after free regression

[Christian König]

Hi everyone,

as discussed in a separate thread Jonghyuk Kim(MalHyuk) stumbled over an
use after free which we through should have already been fixed last
year.

Turned out that a recent patch regressed that by limiting the check to
the ops pointer instead of checking both ops and signaling status of a
dma_fence.

Fix this and also add a few lines of comments to drm_sched_fini() to
document the necessity of an RCU barriere after signaling the last
drm_sched_fence object.

Please review and comment,
Christian.

[PATCH 1/2] dma-buf/dma-fence: fix checking signaling bit for timeline and driver name

[Christian König]

The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference"
changed the check to test for the ops pointer instead of the signaled
bit to avoid a potential NULL dereference when the ops pointer has been
cleared.

The problem is now that the ops pointer is cleared only when neither the
release nor the wait callback is implemented and this isn't true for a lot
of dma_fence implementations yet. So those implementations lost the RCU
protection after signaling of the returned string resulting in potential
use after free.

Add the signaling check additional to the ops pointer check so that we
have both the protection against NULL dereference as well as the RCU
protection after signaling for the returned string.

Signed-off-by: Christian König <christian.koenig@amd.com>
Fixes: 035219a760ed ("dma-buf: dma-fence: Fix potential NULL pointer dereference")
CC: stable@vger.kernel.org # 7.2+
Reported-by: Jonghyuk Kim(MalHyuk) <malhyuk97@gmail.com>
Tested-by: Jonghyuk Kim(MalHyuk) <malhyuk97@gmail.com>
---
 drivers/dma-buf/dma-fence.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c
index 05090fb0fd5a..e92f9df8d63c 100644
--- a/drivers/dma-buf/dma-fence.c
+++ b/drivers/dma-buf/dma-fence.c
@@ -1170,7 +1170,7 @@ const char __rcu *dma_fence_driver_name(struct dma_fence *fence)
 
 	/* RCU protection is required for safe access to returned string */
 	ops = rcu_dereference(fence->ops);
-	if (ops)
+	if (!dma_fence_test_signaled_flag(fence) && ops)
 		return (const char __rcu *)ops->get_driver_name(fence);
 	else
 		return (const char __rcu *)"detached-driver";
@@ -1203,7 +1203,7 @@ const char __rcu *dma_fence_timeline_name(struct dma_fence *fence)
 
 	/* RCU protection is required for safe access to returned string */
 	ops = rcu_dereference(fence->ops);
-	if (ops)
+	if (!dma_fence_test_signaled_flag(fence) && ops)
 		return (const char __rcu *)ops->get_timeline_name(fence);
 	else
 		return (const char __rcu *)"signaled-timeline";
-- 
2.43.0

[PATCH 2/2] drm/sched: document the RCU dependency

[Christian König]

Tvrkos patches added RCU protection to the returned strings from
get_timeline_name()/get_driver_name() callbacks of the dma_fence
backends.

This fixed use after free problems for a couple of drivers, but we never
documented the consequences for the drm_sched_fence.

Add a few words on the function documentation to note that we need an
RCU grace period between signaling the last scheduler fence and
scheduler teardown.

Signed-off-by: Christian König <christian.koenig@amd.com>
---
 drivers/gpu/drm/scheduler/sched_main.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
index 6cb6f9546493..22103cb07782 100644
--- a/drivers/gpu/drm/scheduler/sched_main.c
+++ b/drivers/gpu/drm/scheduler/sched_main.c
@@ -1203,6 +1203,10 @@ static void drm_sched_cancel_remaining_jobs(struct drm_gpu_scheduler *sched)
  * is implemented, all jobs will be canceled through it and afterwards cleaned
  * up through &struct drm_sched_backend_ops.free_job. If cancel_job is not
  * implemented, memory could leak.
+ *
+ * The scheduler fences timeline name is returned protected by the signaled
+ * status and RCU, so an RCU grace period is necessary between signaling the
+ * last scheduler fence and tearing down the scheduler who originated it.
  */
 void drm_sched_fini(struct drm_gpu_scheduler *sched)
 {
-- 
2.43.0

Re: [PATCH 2/2] drm/sched: document the RCU dependency

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing RCU grace period before freeing the drm_gpu_scheduler leads to Use-After-Free.
--

commit 11a9a68f368e39faaeb53298fa915ab4e38a08eb
Author: Christian König <ckoenig.leichtzumerken@gmail.com>

drm/sched: document the RCU dependency

This commit adds documentation to drm_sched_fini() noting that an RCU grace
period is necessary between signaling the last scheduler fence and tearing
down the scheduler. It clarifies the consequences of adding RCU protection
to the returned strings from dma_fence backends.

> diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
> index 6cb6f95464938..22103cb077824 100644
> --- a/drivers/gpu/drm/scheduler/sched_main.c
> +++ b/drivers/gpu/drm/scheduler/sched_main.c
> @@ -1203,6 +1203,10 @@ static void drm_sched_cancel_remaining_jobs(struct drm_gpu_scheduler *sched)
>   * is implemented, all jobs will be canceled through it and afterwards cleaned
>   * up through &struct drm_sched_backend_ops.free_job. If cancel_job is not
>   * implemented, memory could leak.
> + *
> + * The scheduler fences timeline name is returned protected by the signaled
> + * status and RCU, so an RCU grace period is necessary between signaling the
> + * last scheduler fence and tearing down the scheduler who originated it.
>   */
>  void drm_sched_fini(struct drm_gpu_scheduler *sched)
>  {

[Severity: High]
This isn't a bug introduced by this patch, but since we are documenting the
RCU grace period requirement here, does drm_sched_fini() or its callers
actually enforce this grace period?

Looking at several drivers, the scheduler memory is freed synchronously
immediately after calling drm_sched_fini() without an intervening
synchronize_rcu(). For example, in panthor_vm_destroy()
(drivers/gpu/drm/panthor/panthor_mmu.c):

    drm_sched_entity_destroy(&vm->entity);
    drm_sched_fini(&vm->sched);
    /* ... */
    kfree(vm);

Similarly, in aie2_hwctx_fini() (drivers/accel/amdxdna/aie2_ctx.c) and
msm_gem_vm_close() (drivers/gpu/drm/msm/msm_gem_vma.c), the scheduler
memory is freed synchronously after calling drm_sched_fini().

Since unprivileged userspace can control the creation and destruction of
VMs and contexts via standard driver ioctls, could this lead to a
use-after-free? Concurrently, the RCU read-side critical section in
dma_fence_get_timeline_name() can access the freed scheduler pointer
(fence->sched->name). Should synchronize_rcu() be added, or the free
deferred using kfree_rcu(), to prevent this UAF?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909131808.2201-1-christian.koenig@amd.com?part=2

Re: [PATCH 2/2] drm/sched: document the RCU dependency

[Philipp Stanner]

On Wed, 2026-09-09 at 15:14 +0200, Christian König wrote:
> Tvrkos patches added RCU protection to the returned strings from
> get_timeline_name()/get_driver_name() callbacks of the dma_fence
> backends.
> 
> This fixed use after free problems for a couple of drivers, but we never
> documented the consequences for the drm_sched_fence.
> 
> Add a few words on the function documentation to note that we need an
> RCU grace period between signaling the last scheduler fence and
> scheduler teardown.
> 
> Signed-off-by: Christian König <christian.koenig@amd.com>
> ---
>  drivers/gpu/drm/scheduler/sched_main.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
> index 6cb6f9546493..22103cb07782 100644
> --- a/drivers/gpu/drm/scheduler/sched_main.c
> +++ b/drivers/gpu/drm/scheduler/sched_main.c
> @@ -1203,6 +1203,10 @@ static void drm_sched_cancel_remaining_jobs(struct drm_gpu_scheduler *sched)
>   * is implemented, all jobs will be canceled through it and afterwards cleaned
>   * up through &struct drm_sched_backend_ops.free_job. If cancel_job is not
>   * implemented, memory could leak.
> + *
> + * The scheduler fences timeline name is returned protected by the signaled
> + * status and RCU, so an RCU grace period is necessary between signaling the
> + * last scheduler fence and tearing down the scheduler who originated it.
>   */

The API user does not signal a "scheduler fence", typically. Are you
referring to the hardware-fence?

The user must signal all hardware-fences, which will cause all
finished-fences (which are at the root of the addressed problem) to be
signaled.

So what you probably want to say is "The user must wait one RCU grace
period between signaling the last hardware-fence and calling this
function because …".


P.

Re: [PATCH 2/2] drm/sched: document the RCU dependency

[Christian König]

On 9/9/26 15:55, Philipp Stanner wrote:
> On Wed, 2026-09-09 at 15:14 +0200, Christian König wrote:
>> Tvrkos patches added RCU protection to the returned strings from
>> get_timeline_name()/get_driver_name() callbacks of the dma_fence
>> backends.
>>
>> This fixed use after free problems for a couple of drivers, but we never
>> documented the consequences for the drm_sched_fence.
>>
>> Add a few words on the function documentation to note that we need an
>> RCU grace period between signaling the last scheduler fence and
>> scheduler teardown.
>>
>> Signed-off-by: Christian König <christian.koenig@amd.com>
>> ---
>>  drivers/gpu/drm/scheduler/sched_main.c | 4 ++++
>>  1 file changed, 4 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
>> index 6cb6f9546493..22103cb07782 100644
>> --- a/drivers/gpu/drm/scheduler/sched_main.c
>> +++ b/drivers/gpu/drm/scheduler/sched_main.c
>> @@ -1203,6 +1203,10 @@ static void drm_sched_cancel_remaining_jobs(struct drm_gpu_scheduler *sched)
>>   * is implemented, all jobs will be canceled through it and afterwards cleaned
>>   * up through &struct drm_sched_backend_ops.free_job. If cancel_job is not
>>   * implemented, memory could leak.
>> + *
>> + * The scheduler fences timeline name is returned protected by the signaled
>> + * status and RCU, so an RCU grace period is necessary between signaling the
>> + * last scheduler fence and tearing down the scheduler who originated it.
>>   */
> 
> The API user does not signal a "scheduler fence", typically. Are you
> referring to the hardware-fence?

Yes, of course. Signaling the HW fence then causes the scheduler fence to signal as well.

> 
> The user must signal all hardware-fences, which will cause all
> finished-fences (which are at the root of the addressed problem) to be
> signaled.
> 
> So what you probably want to say is "The user must wait one RCU grace
> period between signaling the last hardware-fence and calling this
> function because …".

k, going to fix that.

Thanks,
Christian.

> 
> 
> P.

Re: [PATCH 1/2] dma-buf/dma-fence: fix checking signaling bit for timeline and driver name

[Philipp Stanner]

On Wed, 2026-09-09 at 15:14 +0200, Christian König wrote:
> The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference"
> changed the check to test for the ops pointer instead of the signaled
> bit to avoid a potential NULL dereference when the ops pointer has been
> cleared.
> 
> The problem is now that the ops pointer is cleared only when neither the
> release nor the wait callback is implemented and this isn't true for a lot
> of dma_fence implementations yet. So those implementations lost the RCU
> protection after signaling of the returned string resulting in potential
> use after free.
> 
> Add the signaling check additional to the ops pointer check so that we
> have both the protection against NULL dereference as well as the RCU
> protection after signaling for the returned string.
> 
> Signed-off-by: Christian König <christian.koenig@amd.com>
> Fixes: 035219a760ed ("dma-buf: dma-fence: Fix potential NULL pointer dereference")
> CC: stable@vger.kernel.org # 7.2+
> Reported-by: Jonghyuk Kim(MalHyuk) <malhyuk97@gmail.com>
> Tested-by: Jonghyuk Kim(MalHyuk) <malhyuk97@gmail.com>
> ---
>  drivers/dma-buf/dma-fence.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c
> index 05090fb0fd5a..e92f9df8d63c 100644
> --- a/drivers/dma-buf/dma-fence.c
> +++ b/drivers/dma-buf/dma-fence.c
> @@ -1170,7 +1170,7 @@ const char __rcu *dma_fence_driver_name(struct dma_fence *fence)
>  
>  	/* RCU protection is required for safe access to returned string */
>  	ops = rcu_dereference(fence->ops);
> -	if (ops)
> +	if (!dma_fence_test_signaled_flag(fence) && ops)

It's probably a good idea to comment at an appropriate place (I suggest
here and at dma_fence_ops) why this is necessary, because at all other
places the ops-pointer can serve as decoupling point.

Reason is simply to also support drivers that implement release() and 
wait(), preventing ops from being set to NULL.


P.