From: "Danilo Krummrich" <dakr@kernel.org>
To: "Jonghyuk Kim(MalHyuk)" <malhyuk97@gmail.com>
Cc: <phasta@kernel.org>, <christian.koenig@amd.com>,
<tursulin@ursulin.net>, <matthew.brost@intel.com>,
<dri-devel@lists.freedesktop.org>, <linux-kernel@vger.kernel.org>,
<mdaenzer@redhat.com>, <alessio.belle@imgtec.com>,
<luigi.santivetti@imgtec.com>, <stable@vger.kernel.org>
Subject: Re: [PATCH v4 1/3] drm/sched: cache the timeline name to fix a use-after-free
Date: Fri, 04 Sep 2026 11:57:44 +0200 [thread overview]
Message-ID: <DL6FYL70FVCX.10MCZIPFSVJ5G@kernel.org> (raw)
In-Reply-To: <20260904080618.2098450-2-malhyuk97@gmail.com>
On Fri Sep 4, 2026 at 10:06 AM CEST, Jonghyuk Kim(MalHyuk) wrote:
> Fixes: 506aa8b02a8d ("dma-fence: Add safe access helpers and document the rules")
> Cc: stable@vger.kernel.org # we don't know since when
How is that? If there's a Fixes: tag it expresses that this commit introduced
the bug, so it should be known exactly since when it is present.
However, I don't think this is the correct Fixes: tag, the bug was present
before. I think it was present all the way back to commit f556cb0caeec
("drm/amd: add scheduler fence implementation (v2)").
It is also not the case that it wasn't a bug before we had per-context
schedulers, it's just that it became much more likely to trigger with
per-context schedulers; nothing prevents the kernel from having a reference
count of a DMA fence after the driver was unbound and hence the
per-device/per-ring scheduler was torn down.
More in general, putting "we don't know since when" for the stable folks is
rough. If neither the author of the patch nor the maintainers of the subsystem
can figure it out, how are the stable folks supposed to?
next prev parent reply other threads:[~2026-09-04 9:57 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-04 8:06 [PATCH v4 0/3] drm/sched: fix use-after-free of the fence timeline name Jonghyuk Kim(MalHyuk)
2026-09-04 8:06 ` [PATCH v4 1/3] drm/sched: cache the timeline name to fix a use-after-free Jonghyuk Kim(MalHyuk)
2026-09-04 8:18 ` sashiko-bot
2026-09-04 8:20 ` Christian König
2026-09-04 8:31 ` Philipp Stanner
2026-09-04 12:49 ` Christian König
2026-09-04 19:06 ` Philipp Stanner
2026-09-04 8:31 ` Jonghyuk Kim(MalHyuk)
2026-09-04 8:39 ` Philipp Stanner
2026-09-04 9:11 ` Jonghyuk Kim(MalHyuk)
2026-09-04 9:07 ` Tvrtko Ursulin
2026-09-04 9:57 ` Danilo Krummrich [this message]
2026-09-04 10:51 ` Philipp Stanner
2026-09-04 8:06 ` [PATCH v4 2/3] drm/sched: add the fence ops-detach cleanup to the TODO list Jonghyuk Kim(MalHyuk)
2026-09-04 8:06 ` [PATCH v4 3/3] drm/sched/tests: add a UAF regression test for the timeline name Jonghyuk Kim(MalHyuk)
2026-09-04 8:15 ` sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DL6FYL70FVCX.10MCZIPFSVJ5G@kernel.org \
--to=dakr@kernel.org \
--cc=alessio.belle@imgtec.com \
--cc=christian.koenig@amd.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luigi.santivetti@imgtec.com \
--cc=malhyuk97@gmail.com \
--cc=matthew.brost@intel.com \
--cc=mdaenzer@redhat.com \
--cc=phasta@kernel.org \
--cc=stable@vger.kernel.org \
--cc=tursulin@ursulin.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox